19,840 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 3 months
seen 20 mins ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jan
20
answered Is this acceptable login security?
Jan
18
answered How to store banking information,collected on website, securely and implement encryption?
Jan
16
awarded  Nice Answer
Jan
14
comment Are passwords stored in memory safe?
@CodesInChaos - Exactly. SecureString uses the Data Protection API; which was reverse engineered in 2010 (not sure if MS has changed since then). Its not trivial to break (e.g., if you had full access to a system; its much easier to just capture the password before it hit the SecureString with say a keylogger). However, since the running application has to be able to decrypt it; a sophisticated analysis (with full access to disk/memory) has to be able to recover it.
Jan
14
comment Are passwords stored in memory safe?
@Giffyguy - It makes sense to use a SecureString in .NET for several reasons, but it doesn't prevent sophisticated "hackers who sneak peeks at your applications memory" from getting at the password; it adds obfuscation though. SecureStrings will be encrypted in memory; however the key to decrypt will necessarily also be in memory. Still this is better than a plaintext pw in memory, so it isn't ever exposed in a coredump/swapfile/etc.
Jan
13
answered UNION SQL Injection
Jan
10
comment Is Django's built-in security enough?
Also to answer @freshquiz questions: extra() is fine if its not based on manual string processing like Entry.objects.extra(where=['%headline=%s' % user_input]). There is a safe way to do that -- with params that makes it a bound parameter see: docs.djangoproject.com/en/dev/ref/models/querysets/… . Also no problem with initially developing without SSL, just be sure to thoroughly test with SSL before deploying.
Jan
10
comment Is Django's built-in security enough?
+1 - D.W. had a great comprehensive answer, but you should definitely be aware of the types of attacks and code safely using best practices. Django has a great framework, but even the best tool let's you still do stupid things. E.g., if you say modify DB data based on HTTP GET requests (instead of POST) you are vulnerable to CSRF. Or if you let users inject HTML content that you've mark_safe or {{ something|safe }}, they maybe able to inject say an HTML <script> element on the page for XSS. Or if you have django call a python shell command based on user input (to say create a file).
Jan
2
answered Is it possible to change the wifi password with a script?
Dec
31
comment Future proof encryption possible in theory?
To quote wikipedia: "One-time pads solve few current practical problems in cryptography ... Because the pad, like all shared secrets, must be passed and kept secure, and the pad has to be at least as long as the message, there is often no point in using one-time padding, as you can simply send the plain text instead of the pad (as both can be the same size and have to be sent securely)." This fault is only present with the OTP; not with say key generated from a passphrase with a KDF.
Dec
31
comment Future proof encryption possible in theory?
@GrahamHill, KeithS - You are ignoring KDFs. It's easy to commit a high-entropy passphrase (say ~10+ random dictionary words) to memory to the individuals who need permission (passed generation to generation). You can clearly document the key derivation function used with the encrypted message. With an OTP, on the other hand you need to keep a secret message of the same length as the total length of all the encrypted messages.
Dec
27
comment Future proof encryption possible in theory?
@Cromulent - Yes, you gain a little security via obscurity (the location of the N bank lock boxes; make you break it N+1 times -- generalizing to the case where your message was XORed with N different OTP). But from Kirchhoff's principle, you strive for more than security by obscurity. The designed in security arises only from the lockbox; (and any lockbox can be broken -- picking a lock, forging a signature, bribing your way in, is not impossible like brute forcing a good implementation of AES-256). Not to say OTP is useless; just long term encrypted message storage is not a good fit for it.
Dec
23
awarded  Cleanup
Dec
23
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
rolled back to a previous revision
Dec
22
comment Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
@Gourneau - Why do think DEBUG must be False? Obviously it should be in a secure application (giving attackers debugging info helps them immensely) but every part of the answer seems to work regardless of the debug mode setting.
Dec
22
comment Future proof encryption possible in theory?
The problem of the one-time-pad (OTP) is that if anyone ever needs to decrypt the message, they need to be able to store the OTP somehow in complete secrecy. Since the OTP is the same length as the original message, this will be a very difficult task. By this measure, they could forgo encrypting the message and just do whatever they do to the protect the OTP and do it to the plaintext message.
Dec
22
revised Future proof encryption possible in theory?
added 15 characters in body
Dec
22
answered Future proof encryption possible in theory?
Dec
19
comment Is my developer's home-brew password security right or wrong, and why?
@bradley.ayers - I understand the difference (ciphers are used for encryption; hashing is not encryption as its not reversible.) The meme image first used the word "cipher", and I didn't criticize Rory as cryptographic hash function like MD5 and SHA1 are based on algorithms similar to block ciphers: en.wikipedia.org/wiki/… However, Dave didn't create his own cipher/hash functions or anything similar. He merely did a dumb permutation of an MD5 at one step of a weak hashing scheme (sha1(salt+md5(pw)).
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
He applies crypt(user+random+time) to generate a salt (he must store the crypt, or random, time) in the db. He does not apply crypt of the password.