22,939 reputation
343106
bio website
location Brooklyn, NY
age 34
visits member for 4 years, 3 months
seen 22 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


1d
comment HTTPS POST request header versus request body
This question doesn't seem to be asking about including API keys in the URL, but a HTTP request header versus in the request body (like how a POST form gets sent with parameter=value after the blank line between HTTP headers. Also if you are worried about random HTTP headers getting logged; note session cookies are sent in HTTP headers.
Aug
24
comment Encryption - should I be using RSA or AES?
You can check for every message with a value of 0 to N-1, we have the identity (m^e % N)^d % N == m for both either key pair. Now let's try a short message m = 11 with your scheme. We encrypt with A's private key and get 2707. The next step is problematic as 2707 is greater than B's N. A doesn't notice this and encrypts this value with B's public key to get 1272. A sends 1272 over to B, who decrypts it with his private key to gets 780 which is decrypted with A's public key to get m' = 1607 which is not 11 (however this scheme will work with say m=12, m=13).
Aug
24
comment Encryption - should I be using RSA or AES?
The system OP describes asks to support "plaintext with potentially unlimited length". Textbook RSA doesn't do that or have a scheme for how to securely split up messages that are larger than the key's modulus; because in practice you always do hybrid RSA as its quicker and safer. Quick example why your method of double encryption won't work with very small RSA keys (6-bit primes for 12-bit RSA) to keep it simple using textbook RSA. A's public key is: (N=3127, e=3) and A's private key is (N=3127, d=2011). B's public key (N=1927, e=3) and B's private key (N=1927, d=1227).
Aug
20
comment Encryption - should I be using RSA or AES?
(2) Textbook RSA ( c = m^e mod N and m = c^d mod N) has shortfalls and vulnerabilities when directly encrypting messages. Therefore you should use hybrid encryption -- encrypt the message with symmetric encryption (e.g., AES) with a new random key and then append the encrypted AES random key using the recipient's public RSA key to encrypt with some sort secure padding scheme like OAEP. (I almost didn't like your AES trickier comment - but if Alice and Bob are only people with a shared sym. key they have same guarantees).
Aug
20
comment Encryption - should I be using RSA or AES?
I wasn't the downvoter, but am guessing it was for either: (1) Calling signing "encrypt [the message] with Alice's private key" and verifying by "decrypting [the message] with a public key" and acting like there is one encrypted message. For signing messages you first cryptographically hash the message then encrypt the hash of the message with your private key. For verifying message you decrypt the hash with the other's public key and compare against the hash of the decrypted message. You hash first as RSA can only act on messages smaller than N; RSA-2048 can only encrypt 256 bytes.
Jul
22
comment Token-based authentication - what's a good token length?
Meanwhile if your application has say 10 million session tokens in existence, and some botnet attacks your application and manages to do a million requests per second, it would take ~21 days to find one of the 10 million existing session tokens. With a 128-bit session token, it would take more than 10 million times the age of the universe (10 million x 13.7 billion years) to find one of the 10 million session tokens. And with 128-bit, you don't run into collision problems until you have about 2^64 tokens out there which is about 2 billion tokens for every human on earth).
Jul
22
comment Token-based authentication - what's a good token length?
The reason 64-bit is insufficient is that you often don't need to find a specific session token and your system may have millions or billions of session tokens. The chance of session tokens natually colliding among users happens at 2^32~4 billion tokens (see birthday problem ). This could be problematic; and it is not unreasonable to expect very large web applications (or attacked web applications) to eventually generate 4+ billion session tokens.
Jun
30
comment is it easier to eavesdrop on ethernet connection rather than wifi?
This is simply false. WPA and WPA2 (and even WEP, though WEP is broken and should not be used) encrypts the radio transmissions between your laptop/mobile device and the wifi access point.
May
27
comment How to hack into a remote mysql database?
Yes. The MITM tricks the client into believing the server doesn't support SSL. You fix this by upgrading the clients to 5.7.3 or greater, or don't talk to your database over untrusted networks (e.g., use it only as a local application, or a small private network, or over a secure VPN).
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
My point was from a security perspective, its safer to tell you after inputting a password in a form that will be modified prior to hashing, that "we don't allow passwords greater than 8 characters/with this special character/with unicode characters/with starting/trailing whitespace" while you are setting your password.
Apr
18
comment Do search engines give searcher's IP address to sites that come up in search?
@tim - if the site owner uses google analytics, you get the searched keywords from looking at the analytics. (You won't get them for each individual user straight from google; but if you say cross reference info from the time, user agent, etc with keyword searches you can match them up in your logs.
Apr
3
comment Would the authorities in my college be able to see what websites I accessed through tunneling(SSH)?
ssh -D supports both SOCKS4/SOCKS5 (and man ssh explicitly says it supports SOCKS4 & 5 under the -D option in OpenSSH v6.2 or v6.6). SOCKS5 support has been in OpenSSH since version 3.7 (released Sept 2003). You still have to make sure that you are using SOCKS5 not SOCKS4 (when you configure your browser to connect to the proxy), and that DNS is being done through the tunnel, e.g., in firefox you'll have to enable network.proxy.socks_remote_dns in about:config.
Mar
12
comment Why for some SSL websites browsers show extra info, while for others dont
The benefit of EV certificates is they do fact checking. So if an attacker manages to get a domain like thepaypal.website, the attacker could get regular class-1 SSL certificates for it, but not EV ones as they would not be able to prove they are legal identity paypal.
Mar
12
comment Why for some SSL websites browsers show extra info, while for others dont
-1 - This is wrong. Self-signed certificates will present a scary dialog "Don't trust this connection". The no green box is for regular CA signed class-1 certificates. This validates that the owner of the certificate also controls the domain. (E.g., you bought example.com and can receive emails at admin@example.com). The certificates with the large green boxes are the extended validation certificates which verify that a domain belongs to a real life organization (and the green box displays what organization).
Nov
20
comment Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
@user10008 - My mistake. I thought "or better" was responding to DigitalChris not to TomLeek. My bad.
Nov
20
comment Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
@user10008 - Disabling password entry in /etc/shadow is probably not desirable, as typically you may want the ability login to the machine via password when you are physically present (without requiring any of the standard tricks like booting into single user mode or mounting the hard drive from a live cd/usb and editing /etc/shadow ). You would also have to replace the password entry for every user to have the equivalent to PasswordAuthentication no.
Nov
14
comment Truly deniable encryption
What prevents the adversary from cloning the encrypted hard drive first before typing any passwords? (E.g., if a nuke password is given, just copy the clone again);
Nov
8
comment help identifying an IP address from email sent from my gmail account
The only IP address in there is 10.25.30.3 -- an internal IP address used by a google server. (IP address that start with 10. are used for private internal IP addresses ). Change your password and/or enable 2-factor authentication. Don't access your email on public computers that you do not control (and could be using a keyloggers to steal passwords).
Nov
3
comment SSL with GET and POST
@threeFourOneSixOneThree - It is possible for sites to strip sensitive information via javascript. However, by default (at least with all the browsers that I've tested), the referer header includes all HTTP GET query parameters. I've created a link on reddit to whatismyreferer.com (which echos the referer information that websites commonly log). Go to this link with GET parameters at the end like: reddit.com/r/sandboxtest/comments/2l7adf/referer_test/… and you will find the sensitive parts are part of the referer header (even with https).
Oct
30
comment Can anyone be hacked?
I don't agree that everything can be defended effectively from a targeted attack. Yes, you can defend against buffer overflows, SQL injection, etc type attacks. But if some gov't agency with nearly unlimited resources wants to get into your computers -- they can. They may have to bribe people to steal trusted certificates or make "honest" mistakes like heartbleed or just give you access, steal and alter your incoming packages to modify your hardware, break-in and covertly insert hardware keyloggers, threaten someone with access with imprisonment for non-compliance, etc.