Reputation
24,843
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
4 51 114
Newest
 Enlightened
Impact
~1.7m people reached

Jan
13
revised Is it possible for my password to have more than one password combination?
deleted 7 characters in body
Jan
13
comment Is it possible for my password to have more than one password combination?
In this context, it means approximately equals; it has other meanings in other math contexts, see en.wikipedia.org/wiki/Tilde#Mathematics . The main reason for not using the slightly clearer ≃ is that unicode is harder to type. As for where it comes from 2^256 = 115792089237316195423570985008687907853269984665640564039457584007913129639936 = 1.1579... x 10^77 ~ 10^77 (I originally had off-by-one typo). If you want to find what power it is you could just set 2^256 = 10^x then take the log of both sides and use well-known properties of logs to find x = 256 log(2) / log(10) ~ 77.
Jan
12
answered How to securely counter users from adding a single digit to their old password upon creating a new one?
Jan
12
revised Is it possible for my password to have more than one password combination?
added 567 characters in body
Jan
12
answered Is it possible for my password to have more than one password combination?
Jan
8
comment Does holding an AES-encrypted string and its cleartext from a database help an attacker in decrypting other parts of the database
Not saying anything is wrong with Xander's answer, but feel like adding that this answer assuming AES (the block cipher encryption function) is being used properly then it will be CPA-secure (as far as we know). If you used AES in say ECB mode (which should never be used), then an attacker can do chosen plaintext attacks on your database by encrypting various likely plaintexts and seeing wherever it matches encrypted data. Or if you used AES in CTR mode but the same seed is used to encrypt different data, then you've lost semantic security if the attacker can do chosen-plaintext attacks.
Jan
5
awarded  Good Question
Jan
4
awarded  Famous Question
Jan
2
comment GET Security over HTTPS
As well as Is there a difference between GET and POST for web application security? and probably several other questions.
Jan
2
comment Are zip codes considered to be personal identifying information?
@JanDoggen Really it depends on the legal authority and the specific use. It's probably safest to assume for personal use that it is PII and to appropriately deidentify as HHS suggests, but in most cases the five-digit zip alone will not be able to uniquely identify individuals.
Jan
2
comment Are zip codes considered to be personal identifying information?
I didn't directly answer it, because like many questions its not a simple yes/no. If your health care provider mails you a letter and your zip code is showing on the outside of an envelope to your mail carrier, is that a privacy breach? Obviously it would be if they printed your SSN, date of birth, credit card number on the envelope it would be. Or if only one family resides in a zip code and you are listed as a customer your privacy was violated (though this rare case happens for about 0.00001% of Americans), so it would break HIPAA to publicly state someone from 30334 had illness X.
Jan
1
awarded  Good Answer
Jan
1
comment Avoid unauthorized updating of online leaderboard php/sql
If a player submits a series of moves to your server that would produce a high score, your server checks that those moves give the player an appropriate high score even when the game was entirely played offline. Granted this doesn't validate that a human actually found those moves to play on an actual device (versus wrote an AI program to play the game well), but you'll never be able to verify it was done by humans without actually having trustworthy judges watch the human play the game. (And you can add in randomization by treating the seed to your RNG as part of the solution).
Jan
1
comment Avoid unauthorized updating of online leaderboard php/sql
In regards to (1), plenty of games played offline require you to download new levels prior to play. Offline in this context means no internet required while playing. In regards to (2) no, it doesn't require scores to be accepted from unmodified devices. It just requires your trusted server receiving submitted solutions to check the score produced by those moves. For example, say you wrote a Pacman clone that had no randomization (ghost actions only depend on your movements) and a discrete timer of moves (e.g., moves are only registered every tenth of second of the video game clock).
Jan
1
revised Are zip codes considered to be personal identifying information?
added 129 characters in body
Jan
1
awarded  Nice Answer
Jan
1
comment Avoid unauthorized updating of online leaderboard php/sql
Second, I agree this won't work for a mobile game with completely open source code that you can run on untrusted hardware. But I think it's worthwhile to say that while difficult this problem can be solved on trusted hardware that only runs trusted unmodified software (and this is how online high scores work for video games running on xbox, playstation, etc). And nothing in the question prevents this -- someone could design hardware devices that run a modified android that only runs signed javascript applications and digitally signs submitted scores.
Jan
1
comment Avoid unauthorized updating of online leaderboard php/sql
@TTT - First, about server time vs client time, reread what I wrote -- we are in agreement. I never said anything about trusting a client submitted time. I said you only trust the time that it was submitted as given by the server's clock and then validated server-side to work to produce a given score. I never said anything about looking at a client's time or the client submitting a time. E.g., a puzzle was released at noon and your leaderboard consists of the first people who submitted valid solutions with the times received by the server.
Dec
31
answered Avoid unauthorized updating of online leaderboard php/sql
Dec
31
answered Are zip codes considered to be personal identifying information?