5,959 reputation
11529
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 11 months
seen Jul 27 at 14:14

Jul
16
comment Hashing a credit card number for use as a fingerprint
I think you're too optimistic. Bcrypt doest resist FPGAs very well, and I'd assume the last 4 digits are known to the attacker.
Jul
1
comment Why do ATMs accept any PIN?
@jwg You're nitpicking. With that logic a harddisk or cd doesn't store my data either, since it applies some form of error coding. If the chip stores something from which you can compute the PIN, saying "it stores the PIN" is a perfectly fine abstraction.
Jul
1
comment Why do ATMs accept any PIN?
@jwg That difference is irrelevant. It doesn't really matter how the card encodes or encrypts the PIN. It still has to store and protect something equivalent to the PIN. If somebody manages to bypass the tamper protection of the chip, they can recover the PIN. As Gilles said, it's likely that some form side channel reducing encoding is used.
Jun
26
comment Is 'Bring your own Identity' as the only authentication option a valid practice?
@MarkC.Wallace Mallory logs into your system using evil.com/mallory as identity. evil.com, acting as attribute provider, then claims that it validated mallory's email address as obama@whitehouse.gov. You obviously can't trust that claim. The only way to avoid that problem that I know is creating a whitelist for attribute providers.
Jun
26
comment Is 'Bring your own Identity' as the only authentication option a valid practice?
@MarkC.Wallace But you can only trust the provider if they're on a white-list, no matter what their statement says.
Jun
25
comment Is 'Bring your own Identity' as the only authentication option a valid practice?
1) Your answer is a bit confusing since sometimes "you" refers to the end user (e.g. "your OpenID provider") and sometimes to the website using these credentials. 2) The security properties aren't much different from emails. The the email provider can leak passwords and compromise of the email account propagates to the relying application via password reset.
Jun
25
comment Is 'Bring your own Identity' as the only authentication option a valid practice?
The biggest pitfall I see is that you can't treat data provided by the identity provider as trusted. In particular if it hands you an email address, you can't assume it has been verified.
Jun
25
revised Anyone seen weird messages in their logs?
added 24 characters in body; edited title
Jun
24
comment Is API hooking done by a process in a shared page, visible to all other processes?
Executables are mapped as copy-on-write, not as shared memory.
Jun
23
comment Adding 65K buffer to protect from buffer overflows?
You surely mean a maximum length argument not a minimum length argument
Jun
19
comment A Suitable Replacement for MCrypt?
This isn't about cryptography. It's either about designing a security system involving crypto, in which case it'd fit Information Security or it's about implementing it, belonging on Stack Overflow.
Jun
19
comment A Suitable Replacement for MCrypt?
For the connection itself you must use HTTPS/SSL/TLS. mcrypt is mainly for encrypting data at test, but since you need to store the key where it can be accessed by your web application, the practical security gain is rather small.
Jun
19
comment A Suitable Replacement for MCrypt?
If by payment data, you mean credit card numbers, you'll need to comply which PCI-DSS, which is a pain. The general recommendation is to never let those touch your server, using a PSP instead that receives the CC number and replaces it by an opaque token before it's sent to your server.
Jun
16
comment Can I prevent my neighbors, whom I pay for shared internet (wifi), from seeing the sites I've visited?
Keep in mind that the exist node can sniff all the (unencrypted) traffic. Tor only obscures the link to your original IP.
Jun
16
comment Can I prevent my neighbors, whom I pay for shared internet (wifi), from seeing the sites I've visited?
@Oxinabox Tor performance has improved a lot over the last couple of years.
Jun
16
comment Is it secure to use *no authentication* for services listening only on localhost?
Proxy misconfiguration is unfortunately relatively common.
Jun
16
comment Can TrueCrypt encrypt SSDs without performance problems?
TrueCrypt definitely supports AES-NI. The benchmark dialog says if it's using hardware acceleration and runs at about 1.6 GB/s for my CPU.
Jun
13
awarded  Good Answer
Jun
11
comment Length of passwords that are rainbow table safe
How did you arrive at such a large rainbow table size? My estimation was only 100 GB or so. But I'm hardly an expert on rainbow tables, so I might be off.
Jun
10
comment Length of passwords that are rainbow table safe
Even a single bit es enough to resist rainbow tables if you use properly salted hashes.