Reputation
1,643
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
4 9 13
Newest
 Nice Answer
Impact
~171k people reached

Jan
15
awarded  Nice Answer
Dec
8
comment XKCD #936: Short complex password, or long dictionary passphrase?
@FranKee: The XKCD example only gives 11 bits of entropy per word, so it's assuming a 2048 word dictionary. Even if the brute force attacker uses a dictionary, the 4 random common words have more entropy than the uncommon base word + mutations
Dec
6
comment XKCD #936: Short complex password, or long dictionary passphrase?
@FranKee I don't understand your comment
Nov
21
awarded  Yearling
Nov
2
comment XKCD #936: Short complex password, or long dictionary passphrase?
@wbt Interesting. It's a shame the passwords they were comparing with were only 5-6 characters though. Would be interesting to see a similar comparison with actual security.
Jul
20
awarded  Caucus
Nov
26
comment How strong is a simple XOR encryption with random IV?
Answer: Essentially useless.
Nov
21
awarded  Yearling
Oct
8
comment How secure is my DPAPI Master Key if I enable biometric login?
Answer deleted since Thomas' is better, but point remains: DPAPI doesn't generally prevent someone who steals the machine from stealing your data. See CryptProtectMemory for more details.
Oct
8
comment How secure is my DPAPI Master Key if I enable biometric login?
Ah, I see. +1 then :).
Oct
8
comment How secure is my DPAPI Master Key if I enable biometric login?
If the data is encrypted at rest (e.g. BitLocker or TrueCrypt) then physical access may not be sufficient without a key. But that's not the question the user asked...
Aug
1
comment Can the USB standard be altered to prevent the “firmware attack”?
Firmware bugs have been around for years. The reason you don't see them deployed much in practice is that the money isn't there -- exploits only work against a specific firmware / board / system. It isn't like a browser or Flash or similar you can expect to be on a large percentage of the world's computers.
Aug
1
comment Can the USB standard be altered to prevent the “firmware attack”?
+1. By the Wired standard, nothing could ever connect to anything, because everything may have come in contact with something untrusted somewhere in the past. Firmware is everywhere, and quite a lot of it is buggy.
Jun
17
comment Identical lanman hashes on AD accounts?
It makes me very sad that we are still dealing with the specter of LANMAN hashes given that the last OS that required them (Windows 95) went out of support on December 31, 2001. (Even Win98 supports NTLMv2 with patches)
Nov
21
awarded  Yearling
Oct
25
comment At what point does adding more iterations to PBKDF2 provide no extra security?
I think sun limited Crypto is sufficient :D +1
Sep
25
comment Flash ignores Content-Type header, allowing XSS?
@D.W.: "Giving flash a path" to execute is the same thing as eval -- it is something the web page asked the browser to go fetch and said "this is a SWF, please interpret it that way for me".
Sep
25
answered Flash ignores Content-Type header, allowing XSS?
Apr
23
answered How can JavaScript be tampered with while viewing a web page?
Feb
26
comment When cellphone providers give “unlimited social networking”, how do they identify the traffic?
What vendor is advertising this?