21,443 reputation
33699
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 6 months
seen 1 hour ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Nov
20
comment Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
@user10008 - My mistake. I thought "or better" was responding to DigitalChris not to TomLeek. My bad.
Nov
20
comment Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?
@user10008 - Disabling password entry in /etc/shadow is probably not desirable, as typically you may want the ability login to the machine via password when you are physically present (without requiring any of the standard tricks like booting into single user mode or mounting the hard drive from a live cd/usb and editing /etc/shadow ). You would also have to replace the password entry for every user to have the equivalent to PasswordAuthentication no.
Nov
14
comment Truly deniable encryption
What prevents the adversary from cloning the encrypted hard drive first before typing any passwords? (E.g., if a nuke password is given, just copy the clone again);
Nov
8
comment help identifying an IP address from email sent from my gmail account
The only IP address in there is 10.25.30.3 -- an internal IP address used by a google server. (IP address that start with 10. are used for private internal IP addresses ). Change your password and/or enable 2-factor authentication. Don't access your email on public computers that you do not control (and could be using a keyloggers to steal passwords).
Nov
3
comment SSL with GET and POST
@threeFourOneSixOneThree - It is possible for sites to strip sensitive information via javascript. However, by default (at least with all the browsers that I've tested), the referer header includes all HTTP GET query parameters. I've created a link on reddit to whatismyreferer.com (which echos the referer information that websites commonly log). Go to this link with GET parameters at the end like: reddit.com/r/sandboxtest/comments/2l7adf/referer_test/… and you will find the sensitive parts are part of the referer header (even with https).
Oct
30
comment Can anyone be hacked?
I don't agree that everything can be defended effectively from a targeted attack. Yes, you can defend against buffer overflows, SQL injection, etc type attacks. But if some gov't agency with nearly unlimited resources wants to get into your computers -- they can. They may have to bribe people to steal trusted certificates or make "honest" mistakes like heartbleed or just give you access, steal and alter your incoming packages to modify your hardware, break-in and covertly insert hardware keyloggers, threaten someone with access with imprisonment for non-compliance, etc.
Oct
17
comment Is the option to jump to blanks in password fields a security risk?
@CommuSoft - Agreed. Even if you do encrypt your hard drives, any attacker targeting you with physical access can surreptitiously insert a HW keylogger between your keyboard and computer to get your encryption passphrase.
Oct
16
comment Is the option to jump to blanks in password fields a security risk?
@stuXnet The flaw in that scenario is giving her any access to your computer while the password is typed in. A good password will have some ~60+ bits of entropy (to prevent the hash from being cracked offline); knowledge of a few spaces/special characters reduces it by maybe a dozen bits, but out of the realm of an online attack. If she can secretly find the spaces in the password field, she could say accidentally erase/alter it and force you to retype it (and gain more information by watching you type). Or she gets a confederate to come distract you for a second.
Oct
16
comment Is the option to jump to blanks in password fields a security risk?
@stuXnet - Can you think of a scenario where this could gain any info about the password via this attack, where you couldn't recover the complete password via javascript:var inputs=document.getElementsByTagName('input'); for( var i=0; i < inputs.length; i++ ) { if (inputs[i].getAttribute('type') === 'password') alert(inputs[i].value) }? As an analogy, having the last 4 digits of your credit card # on your receipt stored by a business isn't a security risk, as you just handed your full credit card (with your name, the full number, exp date, CVV, etc) to the person who swiped it.
Oct
14
comment What are the odds of an RSA private key collision?
@Brilliand - Yes that was my intention -- apparently I left out the word times. 10^34 * 10^40 != 10^75, but 10^75 isn't some magic spot but roughly where you start to worry; sqrt(N) is easy to remember point for collision attacks for mental math. Doing the math, at 3x10^34 primes, there's a 10^-81 chance of collision (similar to chance of winning powerball jackpot 10 times in a row playing only 1 ticket each time), at 10^74 a 0.03% chance, at 10^75 a 2.6% chance, at 10^75.5 there's a 23% chance, at 10^76 there's a 92.9% chance, and at at 10^77 its 100% chance (off from 1 by 10^-114 %).
Oct
14
comment What are the odds of an RSA private key collision?
@DavidFoerster - Agree colliding fingerprints are a problem, though with SHA-2 signed certificates (the minimum recommendation these days) you have 256-bit which provides 128-bits of security against collision attacks, assuming SHA-2 doesn't have major weaknesses above brute force. This is the reason SHA-1 are being deprecated as it is feasible for a collision attack on a 160-bit SHA-1 key from rogue government-type attackers to fake an intermediate certificate authority via a collision attack)
Sep
19
comment Facebook drops SSL
@user10008 and @joozek - Facebook has a Strict-Transport-Security header for me when I am logged in. However, if I just run curl -I https://www.facebook.com, I do not see an HSTS header. According to this answer using transport layer security is a configurable option on facebook.
Sep
2
comment Why is security through obscurity not a good option for encryption?
@Evgeni Sergeev - That's a bad idea. If you just take an off the shelf RNG, there's a significant chance you'd using something like a 32-bit random number generator with a small period which would very much be attackable. See this question that states your method is easy to attack with elementary techniques. Even if you combined multiple linear congruential generators with large non-overlapping periods, in essence the parameters of the LCGs are the key - and probably come from a smaller key space and would still be quite vulnerable.
Aug
28
comment What is “c/s” in context of hash cracking?
I think we all agree on what's measured, but do you have a source for "crypts"? Seems equally likely that they intend c as an abbreviation for (hash) calculations per second. Crypts seems like the wrong terminology for hashing (unless its something like bcrypt where the hash is built from a cipher).
Aug
26
comment How does signing work with Elliptic Curve Crypto?
-1 for misinterpretation of equivalence of RSA / EC / symmetric key as needing a 512-bit EC key to encrypt a 256-bit symmetric key. (The equivalence is from the best known attacks; brute forcing an ~15000-bit RSA key with GNFS would take about 2^256 work as would brute-forcing a 256-bit symmetric key for an idealized symmetric cipher; you can easily encrypt a 256-bit symmetric key with a 1024-bit RSA key). Also as dave_thompson_085 pointed out, your answer doesn't really answer the questions or distinguish key exchange from signing.
Aug
26
comment Can anyone recognise this sudden influx of malformed HTTP requests?
Are these requests always from Windows User Agents? Your question and the stackoverflow question both only list windows user agents (from Chrome, Firefox, and IE11).
Aug
20
comment Can HMAC leak the password?
@Gilles - True. One obvious example of an easy to invert, non unique function (by not unique I mean not injective) is sin(x). If I ask you for to solve for x in c = sin(x), you can easily find all solutions x = {2n pi + sin^-1 (c), 2(n+1) pi - sin^-1 (c) } for integer n.
Aug
13
comment Why is a CSR hashed?
@user53029 - Originally, MD5 was used. But MD5 has vulnerabilities specifically chosen-prefix collision attacks. So an attacker first carefully constructs a collision between an unsigned certificate m for a random domain and a fake intermediate certificate authority m', such that MD5(m)=MD5(m'). Then they get a CA to sign the first certificate, and take that signature and append it to their other certificate and now they can sign anything. Hence, you don't use MD5 for signatures anymore and SHA-1/2/3 should be more secure.
Aug
11
comment How to convert http site to full https?
Voting to reopen. I agree detailed step-by-step instructions on how to get a certificate from a specific provider or step-by-step configuration changes necessary for a bunch of specific webservers would probably be out of scope, but a general how to set up an HTTPS seems very in-scope here. It's a problem people actually face, many people do it incorrectly, and while say superuser or another site may get an answer that gets you up and running with HTTPS, it may not be configured securely (e.g., allow weak ciphers, leave in HTTP links/embedded resources, not test your setup).
Aug
10
comment Is MS Windows more secure than Linux on this aspect?
Agree, you should never rely on obscurity for your security. That said, obscurity often doesn't hurt (sometimes comes at expense of usability) and helps as a default when users pick bad passwords. Guessing a user name from M possibilities and password from N choices is a tougher task, means it takes MN work instead of just N. Yes, your username often is not secret in a targeted attack (where they have usernames associated with your IP address from other systems), but there are plenty of non-targeted attacks out there (leave an ssh server on port 22 facing the internet and see the attempts).