19,289 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 2 months
seen 5 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


May
16
revised How secure is Vigenere cipher for random data?
added 848 characters in body
May
16
revised How secure is Vigenere cipher for random data?
added 848 characters in body
May
16
answered How secure is Vigenere cipher for random data?
May
16
comment Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
If properly implemented both can be as secure. My point is saying HTTPS doesn't specify much. How does the client verify the server's identity in your HTTPS API (SSH does this well with host key checking as long as the initial connection wasn't attacked)? How does the server verify the clients identity? Are weak SSL ciphers blocked?
May
16
comment What is the difference between SSL vs SSH? Which is more secure?
@chrisdew - Correct. SSL (secure sockets layer) is an encryption protocol for data in transit that was renamed TLS (transport layer security) about 15 years ago. SSH does not implement either protocol, but uses their own SSH encryption protocol (similar and based on secure ciphers). Yes, there is a popular library named "OpenSSL" which implements SSL, TLS and a number of other cryptographic protocols (e.g., RSA, cryptographic hashes, etc). Similarly there is "OpenSSH", a program that implements the SSH protocol using the OpenSSL library for RSA/DSA key generation but not for SSL.
May
16
revised Precise measurement of password complexity
added 389 characters in body
May
16
answered Precise measurement of password complexity
May
16
revised Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
added 97 characters in body
May
16
revised Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
added 100 characters in body
May
16
answered Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
May
16
revised What would the potential abuses be for an HTTP API that accepted raw SQL?
added 1045 characters in body
May
15
comment What would the potential abuses be for an HTTP API that accepted raw SQL?
What do you mean SSH / IP white list? Can you ensure that your SaaS application (sitting on a few known IPs) needing to use the API only generates trusted SQL queries? Then restricting to whitelisted IPs (and forcing HTTPS or an alternative form of authenticated encryption - with authentication) seems fine -- granted you have to ensure that attackers can't get your application to create bad queries somehow. The regex you suggested should work assuming its done before filtering and other characters are never needed in the SQL - but I'd still recommend parameterized queries.
May
15
revised What would the potential abuses be for an HTTP API that accepted raw SQL?
added 708 characters in body
May
15
revised What would the potential abuses be for an HTTP API that accepted raw SQL?
added 708 characters in body
May
15
answered What would the potential abuses be for an HTTP API that accepted raw SQL?
May
15
comment How to calculate FAR and FRR in pattern recognition?
This doesn't have anything to do with security. Maybe try scicomp.stackexchange.com or cs.stackexchange.com ?
May
15
answered Is it possible to have a high confidence that a password is not being reused?
May
14
revised Can I brute-force a password hash even if I don't know the hash-algorithm used?
added 46 characters in body
May
14
answered Can I brute-force a password hash even if I don't know the hash-algorithm used?
May
12
answered Why was WPS not patched to make it secure?