101 reputation
1
bio website
location
age
visits member for 3 years, 5 months
seen Oct 9 '13 at 22:34

Jun
13
comment Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
If they had secure reinforced concrete vaults and audited processes, they would advertise them. Otherwise they don't gain anything over keeping the private keys in the top drawer of the filing cabinet. Apart from that, this is the same answer as Adnan's - both a key on the server and a key on the client are needed to decrypt the information.
Jan
23
comment Is my bank storing my password in plain text?
my bank (in the UK) uses this as part of a two-factor authentication: a secret password that you enter all of, and a less secret password that you enter selected letters from. Seems like a reasonable choice if they are worried about keyloggers.
Aug
11
comment XKCD #936: Short complex password, or long dictionary passphrase?
The rumkin.com checker is dangerously misleading. It's much less sophisticated than the simple common sense in the XKCD comic, so it shouldn't be used to "confirm" anything. Try it on "passwordpasswordpasswordpassword" which allegedly has 128 bits of entropy and is "overkill" security.
Aug
11
comment XKCD #936: Short complex password, or long dictionary passphrase?
@DanBeale I think the point is that (some) users will always do the minimum required of them, and that services which force users to use a "strong" password with at least one number, one capital letter, one punctuation mark, etc are actually counterproductive (though they look really good to management!)