20,199 reputation
23393
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 4 months
seen 3 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Sep
2
comment Why is security through obscurity not a good option for encryption?
@Evgeni Sergeev - That's a bad idea. If you just take an off the shelf RNG, there's a significant chance you'd using something like a 32-bit random number generator with a small period which would very much be attackable. See this question that states your method is easy to attack with elementary techniques. Even if you combined multiple linear congruential generators with large non-overlapping periods, in essence the parameters of the LCGs are the key - and probably come from a smaller key space and would still be quite vulnerable.
Aug
28
comment What is “c/s” in context of hash cracking?
I think we all agree on what's measured, but do you have a source for "crypts"? Seems equally likely that they intend c as an abbreviation for (hash) calculations per second. Crypts seems like the wrong terminology for hashing (unless its something like bcrypt where the hash is built from a cipher).
Aug
26
comment How does signing work with Elliptic Curve Crypto?
-1 for misinterpretation of equivalence of RSA / EC / symmetric key as needing a 512-bit EC key to encrypt a 256-bit symmetric key. (The equivalence is from the best known attacks; brute forcing an ~15000-bit RSA key with GNFS would take about 2^256 work as would brute-forcing a 256-bit symmetric key for an idealized symmetric cipher; you can easily encrypt a 256-bit symmetric key with a 1024-bit RSA key). Also as dave_thompson_085 pointed out, your answer doesn't really answer the questions or distinguish key exchange from signing.
Aug
26
comment Can anyone recognise this sudden influx of malformed HTTP requests?
Are these requests always from Windows User Agents? Your question and the stackoverflow question both only list windows user agents (from Chrome, Firefox, and IE11).
Aug
20
comment Can HMAC leak the password?
@Gilles - True. One obvious example of an easy to invert, non unique function (by not unique I mean not injective) is sin(x). If I ask you for to solve for x in c = sin(x), you can easily find all solutions x = {2n pi + sin^-1 (c), 2(n+1) pi - sin^-1 (c) } for integer n.
Aug
13
comment Why is a CSR hashed?
@user53029 - Originally, MD5 was used. But MD5 has vulnerabilities specifically chosen-prefix collision attacks. So an attacker first carefully constructs a collision between an unsigned certificate m for a random domain and a fake intermediate certificate authority m', such that MD5(m)=MD5(m'). Then they get a CA to sign the first certificate, and take that signature and append it to their other certificate and now they can sign anything. Hence, you don't use MD5 for signatures anymore and SHA-1/2/3 should be more secure.
Aug
11
comment How to convert http site to full https?
Voting to reopen. I agree detailed step-by-step instructions on how to get a certificate from a specific provider or step-by-step configuration changes necessary for a bunch of specific webservers would probably be out of scope, but a general how to set up an HTTPS seems very in-scope here. It's a problem people actually face, many people do it incorrectly, and while say superuser or another site may get an answer that gets you up and running with HTTPS, it may not be configured securely (e.g., allow weak ciphers, leave in HTTP links/embedded resources, not test your setup).
Aug
10
comment Is MS Windows more secure than Linux on this aspect?
Agree, you should never rely on obscurity for your security. That said, obscurity often doesn't hurt (sometimes comes at expense of usability) and helps as a default when users pick bad passwords. Guessing a user name from M possibilities and password from N choices is a tougher task, means it takes MN work instead of just N. Yes, your username often is not secret in a targeted attack (where they have usernames associated with your IP address from other systems), but there are plenty of non-targeted attacks out there (leave an ssh server on port 22 facing the internet and see the attempts).
Aug
10
comment Is MS Windows more secure than Linux on this aspect?
@JimiDini - Well you can switch to the root account with sudo su -, it's just when the password is not set, you can't login to the root account by knowing an unset root password. @Parithian Shot, I agree in the Kirchhoff principle in general, especially for analyzing security of a system. Granted in practice, it often drastically cuts down on crud in your logs if you do simple restrictions (change SSH from port 22, don't have a user named root or other common names).
Aug
3
comment Ip4v Rainbow Table
@Mark - In this case, it is in the common dotted decimal form of 192.168.0.1.
Aug
2
comment what type of database server is used by fb?
possible duplicate of How can I explain SQL injection without technical jargon?
Aug
2
comment what type of database server is used by fb?
@hellruler - SQL injection by definition requires an SQL database (e.g., oracle, postgresql, sqlite, mysql, MSSQL, etc) and a badly designed application. (It doesn't require the microsoft product with the dumb name of "SQL Server", but better known as MSSQL.) Granted SQL injection is only one type of injection attack; you can have injection attacks on NoSQL databases, code injection in bash/shell/php scripts, etc. Anytime a statement is eval (or equivalent) that contains untrusted user input you are vulnerable to an injection attack. It's only SQL injection if its an SQL statement.
Aug
1
comment What can a hacker do with a card number without CVV?
It's not exactly a duplicate, but the answer there should clear up the misconception that a credit card # alone is worthless.
Jul
31
comment Can ISP use MITM attack to “break” encrypted traffic?
At the exit node, tor traffic is very susceptible to eavesdropping. See: security.stackexchange.com/questions/34804/… and security.stackexchange.com/questions/31589/…
Jul
25
comment How easy is it to crack this encryption algorithm?
@Gilles - Thanks for the suggestion!
Jul
24
comment Can I test/determine all decryption types on an unkown filetype. I do have the password
This question is fundamentally unanswerable. A well-encrypted file is indistinguishable from random data without knowledge of the key or existing meta-data (which there appears to be none) that explains how it was encrypted.
Jul
22
comment Does the SSL termination happen with the ISP or a mobile service provider?
DNS (and ARP) spoofing has nothing to do with SSL or encryption. Yes, it's how you would do a MitM attack on HTTP (no encryption) or with HTTPS if the attacker has gotten their hands on a private SSL key for the faked domain (either through trickery, getting people to trust a bad certificate, actually stealing a certificate, or compromising a CA into signing fake certificates).
Jul
11
comment Any example where client certification is required?
@tangrs - Yes. If you go to startssl.com and try to create a free SSL certificate (e.g., for your website), they'll require you to first generate a SSL certificate for client authentication (to login) with startssl.com instead of a password.
Jun
30
comment Books to start the study of TCP/IP
I wouldn't dive deep into TCP/IP until you've studied survey-level networking. I highly recommend the free coursera networking course and liked Kurose/Ross - Computer Networking (under $20 on amazon if you get used copy of the 5th edition (2009)). Also, if you are mostly interested in security stuff, but find networking basics a bit dry at first, then maybe look at the Web Application Hacker's Handbook for fun, quickly-applicable intro to security in web apps that often introduces some basics (mostly application layer).
Jun
22
comment unfamiliar IP when logging into ssh server
If you don't want to resolve IP addresses to host names (which will often contain the IP address in reverse order), simply use w -i (with GNU tools) or netstat -n.