6,439 reputation
11733
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 2 months
seen 5 hours ago

18h
comment shred - different device size
Nitpick: A lowercase b stands for bits. For bytes use B instead.
18h
comment TLS reliance on System Time
In TLS 1.3 the random fields will probably no longer contain the time. I think several existing client implementations have already eliminated it to avoid fingerprinting.
1d
comment One liner to create passwords in linux?
@Luc Using 95 characters reduces the password length from 22 to 20 characters. Not a big difference.
1d
awarded  Nice Answer
1d
comment Is 3DES outdated for message authentication code computing?
How do you use 3DES? CBC MAC?
1d
revised What is the difference between “key length” and “bit strength”?
added 307 characters in body
1d
answered What is the difference between “key length” and “bit strength”?
2d
comment SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when?
@Anonymouse See Why do the elliptic curves recommended by NIST use 521 bits rather than 512?. In short, P521 uses this prime because 2^521-1 is a mersenne prime.
2d
revised Use cookies once stolen
added 11 characters in body
2d
revised Recovery plan in case of lost Android smartphone with Google Authenticator?
added 15 characters in body
2d
comment One liner to create passwords in linux?
@A.L Because the input stems from hex, which outputs 0-9 and A-F. A-F don't need to be modified, 0-9 are mapped to letters starting from g. 9 happens to map to p. When you map 16 different characters to letters via simple substitution you only reach 16 letters, and p is the 16th letter in the alphabet.
Oct
15
comment What are the odds of an RSA private key collision?
Duplicate on crypto.se: How many RSA keys before a collision?
Oct
14
comment Can Diffie-Hellman be scaled up or force-multiplied?
@AndrewHoffman That's the case, but I don't get your point. If establishing a connection needs a terabyte RSA key and hours of computation, that's not acceptable performance for me.
Oct
14
comment Can Diffie-Hellman be scaled up or force-multiplied?
When you're worried about quantum computers, don't use RSA or Diffie-Hellman. With these algorithms increasing sizes enough to avoid QCs implies unacceptable performance for the defender.
Oct
14
comment Creating secure communication line for mobile payment
Use SSL/TLS and ensure that you're properly validating the certificate. If you directly send the credit card number to the PSP without touching your own server (I strongly recommend doing so, else you'll have lots of expensive fun with PCI) you simply need to do what their API requires (most likely just SSL).
Oct
14
comment How to explain to a customer that spamfilters don't catch everything
Spam filter and anti virus are barely better than throwing a coin.
Oct
10
comment Is it possible to demonstrate that md5(x) != x for any x?
@Gilles Actually that's a slightly different question since it allows additional freedom in choosing the message (contains vs. equals). The fixed point question Thomas mentioned is a closer duplicate. We also have several similar questions about other hashes, like SHA-x.
Oct
10
comment Is it possible to demonstrate that md5(x) != x for any x?
@Desthro The input to MD5 is variable length and supports 128 bit inputs. You're confusing the MD5 compression function, which has a 512 bit input, with the MD5 hash.
Oct
10
comment How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?
Typically clickjacking gets the user to trigger an action which you want them to do but which they wouldn't do otherwise.
Oct
5
comment Why does sha1 return a different hash for the same input string?
security.se is not for debugging your code.