5,680 reputation
11428
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 2 years, 8 months
seen 48 mins ago

9h
comment How secure is to seed PRNGs with the sequences from CSPRNG?
Seeding a CSPRNG or stream cipher from /dev/random is secure. If you never reseed you don't get recovery from state compromise, but that's not very useful in the first place. Another potential issue is that many stream ciphers can be run backwards, so you can recover earlier state and output if you know the current state. This is important for forward secrecy, but of little relevance to games.
Apr
17
reviewed Approve suggested edit on What makes it illegal to use the information learned by exploiting a bug?
Apr
17
reviewed Approve suggested edit on What makes it illegal to use the information learned by exploiting a bug?
Apr
17
comment What makes it illegal to use the information learned by exploiting a bug?
I also said "especially if it's done repeatedly to the same host in order to learn information." which is not true for those scans. They only check if the target is vulnerable, but don't try to collect information using the vulnerability.
Apr
17
comment What makes it illegal to use the information learned by exploiting a bug?
@StephenSolis-Reyes I'd avoid such a scan as an individual since even if it's legal that doesn't prevent somebody from suing you. It's easier to do those scans as a company with enough financial reserves for an extended legal process. Being a credible security company increases your chances to win the process, compared to being an individual like Auernheimer.
Apr
17
comment What makes it illegal to use the information learned by exploiting a bug?
You certainly can't send a heartbleed exploit packet by accident during normal use of the site. So I'd consider the legal risk pretty high, especially if it's done repeatedly to the same host in order to learn information.
Apr
16
comment What happens if biometric data is stolen?
Biometry can only be used as local authentication. Since it's not secret, it relies on the presence of trusted hardware which can tell apart a fake piece of hardware for real fingers/eyes/etc.
Apr
15
comment Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation
28 bits of entropy in a password isn't enough, even with several million iterations.
Apr
15
revised Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation
edited title
Apr
15
reviewed Approve suggested edit on Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation
Apr
14
comment If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?
That assumes that the attacker behaves like you proposed. What if they start with a random password, run until ZZZ jump to aaa until they're at the start?
Apr
14
comment Should service accounts be set to never lock out
I don't see any benefits for service accounts, you just need to configure them to use a strong password. So IMO the DoS risk outweighs the minimal benefits.
Apr
14
comment Are there “secure” languages?
The big problem with "don't use C" is interoperability with other languages. Pretty much any language supports writing a wrapper for C libraries. But you can't easily use say a Java library from C# or Python.
Apr
14
comment Encrypting passwords?
1) RSA is not useful here, since we need symmetric password based encryption 2) Picking an algorithm is easy, actually building something something secure from low level crypto like AES is hard.
Apr
14
comment Advantages of one time pad
For SSL you can use the MAC to see if you found the correct key.
Apr
14
revised Getting an employer to secure their website immediately
deleted 12 characters in body
Apr
12
comment When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this?
Why would an attacker create a new cert? They can simply use the existing cert with the private key they obtained.
Apr
12
comment Password Managers: encrypted database vs hashing strategy
"No encrypted database which has the potential to be found and decrypted" Decrypting that database is at least as hard as recovering the master key from an individual password with the derivation based schemes. (Due to salting it's typically even harder)
Apr
11
comment Does HTTPS retrieval, among its other effects, sign a document?
The document doesn't get signed. Only a small part of the handshake is signed, if at all. The rest of the connection is only protected by MACs, which can be forged by anybody who knows the shared key (at minimum the two end-points of the connection).
Apr
11
comment Is there any point in using 'strong' passwords?
@Łukasz웃Lツ No, you need something beyond quantum computers. QCs only halve the effective key length of symmetric crypto.