19,885 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 3 months
seen 7 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


May
17
revised Stream/Block encryption using XOR and Hash function?
added 126 characters in body
May
17
comment Stream/Block encryption using XOR and Hash function?
@DanielValland - I think its fair to assume if anyone ever deployed this scheme and could say use it to encrypt files or messages, they may apply it multiple times and having a random nonce/IV is very much necessary in that scenario. I've expanded my thoughts on why the MD construction is bad. I still haven't fully worked it out but gave a basic outline of how it would be attackable. Using a different type of hash like Keccak (based on sponge construction) wouldn't be vulnerable in this way, but again using a well-vetted block cipher seems a much better idea.
May
17
revised Stream/Block encryption using XOR and Hash function?
added 772 characters in body
May
17
revised Stream/Block encryption using XOR and Hash function?
added 98 characters in body
May
17
answered Stream/Block encryption using XOR and Hash function?
May
16
revised How secure is Vigenere cipher for random data?
added 848 characters in body
May
16
revised How secure is Vigenere cipher for random data?
added 848 characters in body
May
16
answered How secure is Vigenere cipher for random data?
May
16
comment Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
If properly implemented both can be as secure. My point is saying HTTPS doesn't specify much. How does the client verify the server's identity in your HTTPS API (SSH does this well with host key checking as long as the initial connection wasn't attacked)? How does the server verify the clients identity? Are weak SSL ciphers blocked?
May
16
revised Precise measurement of password complexity
added 389 characters in body
May
16
answered Precise measurement of password complexity
May
16
revised Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
added 97 characters in body
May
16
revised Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
added 100 characters in body
May
16
answered Is HTTPS as secure or more secure than SSH if both have an IP address whitelist?
May
16
revised What would the potential abuses be for an HTTP API that accepted raw SQL?
added 1045 characters in body
May
15
comment What would the potential abuses be for an HTTP API that accepted raw SQL?
What do you mean SSH / IP white list? Can you ensure that your SaaS application (sitting on a few known IPs) needing to use the API only generates trusted SQL queries? Then restricting to whitelisted IPs (and forcing HTTPS or an alternative form of authenticated encryption - with authentication) seems fine -- granted you have to ensure that attackers can't get your application to create bad queries somehow. The regex you suggested should work assuming its done before filtering and other characters are never needed in the SQL - but I'd still recommend parameterized queries.
May
15
revised What would the potential abuses be for an HTTP API that accepted raw SQL?
added 708 characters in body
May
15
revised What would the potential abuses be for an HTTP API that accepted raw SQL?
added 708 characters in body
May
15
answered What would the potential abuses be for an HTTP API that accepted raw SQL?
May
15
comment How to calculate FAR and FRR in pattern recognition?
This doesn't have anything to do with security. Maybe try scicomp.stackexchange.com or cs.stackexchange.com ?