22,644 reputation
340105
bio website
location Brooklyn, NY
age 34
visits member for 4 years, 1 month
seen 2 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jan
10
comment Is Django's built-in security enough?
+1 - D.W. had a great comprehensive answer, but you should definitely be aware of the types of attacks and code safely using best practices. Django has a great framework, but even the best tool let's you still do stupid things. E.g., if you say modify DB data based on HTTP GET requests (instead of POST) you are vulnerable to CSRF. Or if you let users inject HTML content that you've mark_safe or {{ something|safe }}, they maybe able to inject say an HTML <script> element on the page for XSS. Or if you have django call a python shell command based on user input (to say create a file).
Jan
2
answered Is it possible to change the wifi password with a script?
Dec
31
comment Future proof encryption possible in theory?
To quote wikipedia: "One-time pads solve few current practical problems in cryptography ... Because the pad, like all shared secrets, must be passed and kept secure, and the pad has to be at least as long as the message, there is often no point in using one-time padding, as you can simply send the plain text instead of the pad (as both can be the same size and have to be sent securely)." This fault is only present with the OTP; not with say key generated from a passphrase with a KDF.
Dec
31
comment Future proof encryption possible in theory?
@GrahamHill, KeithS - You are ignoring KDFs. It's easy to commit a high-entropy passphrase (say ~10+ random dictionary words) to memory to the individuals who need permission (passed generation to generation). You can clearly document the key derivation function used with the encrypted message. With an OTP, on the other hand you need to keep a secret message of the same length as the total length of all the encrypted messages.
Dec
27
comment Future proof encryption possible in theory?
@Cromulent - Yes, you gain a little security via obscurity (the location of the N bank lock boxes; make you break it N+1 times -- generalizing to the case where your message was XORed with N different OTP). But from Kirchhoff's principle, you strive for more than security by obscurity. The designed in security arises only from the lockbox; (and any lockbox can be broken -- picking a lock, forging a signature, bribing your way in, is not impossible like brute forcing a good implementation of AES-256). Not to say OTP is useless; just long term encrypted message storage is not a good fit for it.
Dec
23
awarded  Cleanup
Dec
23
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
rolled back to a previous revision
Dec
22
comment Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
@Gourneau - Why do think DEBUG must be False? Obviously it should be in a secure application (giving attackers debugging info helps them immensely) but every part of the answer seems to work regardless of the debug mode setting.
Dec
22
comment Future proof encryption possible in theory?
The problem of the one-time-pad (OTP) is that if anyone ever needs to decrypt the message, they need to be able to store the OTP somehow in complete secrecy. Since the OTP is the same length as the original message, this will be a very difficult task. By this measure, they could forgo encrypting the message and just do whatever they do to the protect the OTP and do it to the plaintext message.
Dec
22
revised Future proof encryption possible in theory?
added 15 characters in body
Dec
22
answered Future proof encryption possible in theory?
Dec
19
comment Is my developer's home-brew password security right or wrong, and why?
@bradley.ayers - I understand the difference (ciphers are used for encryption; hashing is not encryption as its not reversible.) The meme image first used the word "cipher", and I didn't criticize Rory as cryptographic hash function like MD5 and SHA1 are based on algorithms similar to block ciphers: en.wikipedia.org/wiki/… However, Dave didn't create his own cipher/hash functions or anything similar. He merely did a dumb permutation of an MD5 at one step of a weak hashing scheme (sha1(salt+md5(pw)).
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
He applies crypt(user+random+time) to generate a salt (he must store the crypt, or random, time) in the db. He does not apply crypt of the password.
Dec
19
comment Is my developer's home-brew password security right or wrong, and why?
For more on collision attacks vs pre-image attacks inspired by the old form of this question, see the second half of my answer.
Dec
19
awarded  Good Answer
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
added 867 characters in body
Dec
19
comment Is my developer's home-brew password security right or wrong, and why?
Funny and agree with the sentiment, but its irrelevant as he didn't write his own cipher. He took existing crypto-hash functions MD5 and SHA1 along with custom permutation function dumb_perm (dumb_perm('00112233445566778899aabbccddeeff') goes to 'ccddeeff8899aabb0011223344556677'), so hash = SHA1(salt++dumb_perm(MD5(pw))) and created their salt in an overly complicated manner. While they've increased their maintenance costs for no gain in security, they are not creating their own cipher--the flaw is that simple hashes are too quick nowadays, so key-strengthening is necessary.
Dec
18
awarded  Nice Answer
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
added 985 characters in body
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
added 985 characters in body