dr jimbob

11,739 reputation

1556

bio	website
	location	Brooklyn, NY
	age	31
visits	member for	2 years
	seen	4 hours ago
stats	profile views	275

Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).

	11,739 reputation	bio	website		visits	member for	2 years
1556 badges		location	Brooklyn, NY		seen	4 hours ago

summary answers questions tags badges favorites bounties reputation activity

862 Actions

suggestions reviews revisions comments badges posts accepts all

Jan 3	comment	Making passwd/shadow files more secure Your best first bet is to restrict physical access -- anyone with physical access can easily put in hardware keyloggers for example even when the drive is encrypted -- wait for you to use it and then replay your keystrokes. Also, for the BIOS solution; you don't want a BIOS password (stored on the motherboard; easily worked around e.g., move to another machine) but hard disk password: en.wikipedia.org/wiki/Parallel_ATA#HDD_passwords_and_security . Note, a determined adversary can work around this (unlike disk encryption), but this will keep out the casual attacker.
Jan 2	comment	Perl script rootkit (exploit) @OlierSaari - Boot off of a live cd (that you know to be safe) mount the hard disk to `/mnt/unsafe_harddrive/` and try running md5sum on the executables of various utilities (e.g., `md5sum /mnt/unsafe_harddrive/usr/sbin/sshd`) and compare the values to the original values from the operating system (and also check that the version is the same). E.g., ubuntu 11.10 (oneric) has `OpenSSH_5.8p1 Debian-7ubuntu1` with a md5sum of `6ea7510e7be723b31af0d586815b6a76 /usr/sbin/sshd`. A program like tripwire can do these rootkit checks automatically. Also don't trust md5sum on your corrupted system.
Jan 2	comment	Perl script rootkit (exploit) @OlierSaari - Have you reinstalled your OS? I doubt it was a flaw in OpenSSH that let them initially break into your systems. One of the first things they did once they did get into your system is install a rootkit that replaces safe utilities like OpenSSH's sshd with a compromised version, e.g., that always accepts a malicious key (e.g., compiled into the binary). This compromised version is based on OpenSSH (so it won't seem to be acting differently); so when you switch ports `sshd_config` the port does change (and apparently their scripts aren't scanning for other ports).
Dec 29	answered	Chrome vs Explorer - how to explain in plain words that open-source is better?
Dec 29	answered	Perl script rootkit (exploit)
Dec 29	answered	Reusing Private/Public Keys
Dec 20	comment	Are passwordless SSH logins more secure? @Piskvor - If you force the idiots who use "PassWord123" to use ssh keys; they'll find a way to be insecure. E.g., why do I need a passphrase on my ssh key -- that's inconvenient (or have a trivial phrase like "this is fun") and then leave the key on multi root-user systems or back up their ssh key in public locations (gmail/dropbox/etc.). At least at the moment, I haven't run into these idiots needing root privileges on my systems.
Dec 20	comment	Are passwordless SSH logins more secure? @Piskvor - I agree a reasonable password on the weaker side (say four word diceware or 8 random lowercase letters) ~2^36 is much smaller space than typical private key space ~2^1000. However, if fail2ban limits bad attempts to ~100/hr per IP address, your password would survive for ~4 billion years from one IP address (or would require ~40 million IP addresses to attack for a 100 years without you noticing). Therefore, they are in practice roughly equally safe as your risk in practice is not being brute-forced, but another route (physical access to your machine; installing malware; etc.).
Dec 20	answered	rsa certificate authorities
Dec 20	revised	Are passwordless SSH logins more secure? deleted 70 characters in body
Dec 20	answered	Are passwordless SSH logins more secure?
Dec 15	comment	JavaScript written only with brackets? It's worth pointing out that this is only a XSS vulnerability if your site executes javascript code that could be provided by untrusted users and your only safeguard is blacklisting certain keywords (which is the wrong solution). You should always use a whitelist policy/safer markup language that prevents users from executing javascript code (e.g., in comments they can't insert `<script>` tags, add `onclick/onhover`-type methods to html tags, or use `eval` on user provided input in your js, etc.). Then this just is obsfuscation.
Dec 14	comment	What happens if two parties have a same pair of public&private keys @Henri - Agree; it was a mistake and I feel silly for not catching it when I saw the other mistake. But it really is insignificant. By the prime number theorem there are asymptotically x/(ln x) primes smaller than x, so there are roughly 2^503 prime numbers between 2^510 and 2^512. This would make it roughly 1/10^303. So if every atom in the observable universe (10^80 atoms) generated a trillion (10^12) keypairs every second since the big bang (4x10^17 sec), you'd only have generated ~10^110 pairs and a collision is still very unlikely.
Dec 14	revised	What happens if two parties have a same pair of public&private keys Fixed typo; 2^-1024 ~ 1/10^308 ; not 1/10^24 (had to add more letters for edit 6 char limit).
Dec 14	suggested	suggested edit on What happens if two parties have a same pair of public&private keys
Dec 14	comment	What happens if two parties have a same pair of public&private keys There's a typo above. (I've edited it; but don't have edit privileges). 2^-1024 ~ 10^-308.3 not about 10^-24. (Remember (b^x)^y = b^(xy); and since 2^3.32 ~ 10, we have 2^-1024 ~ 2^(3.32-308.3) = (2^3.32)^-308.3 ~ 10^-308.3; or just 1024*log(2)/log(10) ~ 308.3
Dec 13	comment	Is using a flash drive as a base for security a safe thing to do? @Ramhound - I read your full comment; and was commenting on the part where you suggested a bad practice that would somehow solve issues. I wasn't commenting on your security card+pin solution that was reasonable (though unlikely to happen in cash-strapped public schools with administrators who put computer security as a low priority). I also agree, that its generally best for people who aren't experts in security to write their own security routines. Its very easy to inadvertently leave yourself vulnerable to major attacks.
Dec 13	comment	Is using a flash drive as a base for security a safe thing to do? Ramhound: avoid frequent forced password changes, it weakens security. Can't exclude users for making too many bad attempts (normal users will forget their ever-changing password). Users will develop bad practices (incremented date in their password; written on post-it on desk), and easier to socially engineer a password reset. `Jan2011PW!` is low entropy (~30bits) assuming month/year in there, so a modern GPU could crack in under a second (~10^9 SHA1/s). And once you find out `Jan2011PW!` was the password in January, you've found future passwords with very little guesswork.
Dec 12	answered	Is using a flash drive as a base for security a safe thing to do?
Dec 12	comment	Is using a flash drive as a base for security a safe thing to do? @Ramhound - Are you serious? We've gotten over the point of every N-day password changes. It doesn't make you safer; it makes the user forgetting the password much more likely, using the simplest password that satisfies the criteria (e.g., Jan2011PW!, Mar2011PW!, etc.) or simply writing down the password nearby.