1,419 reputation
616
bio website
location
age
visits member for 3 years
seen May 20 '12 at 21:36

Nov
27
answered License key / Serial number generator and checker
Oct
21
awarded  Nice Question
Sep
26
awarded  Citizen Patrol
Sep
23
answered Is this much distrust really necessary?
Sep
22
comment How to properly encrypt a communication channel between a client and a server (without SSL)?
Why are you trying to create your own protocol, rather than using an existing one? Is the "no SSL" constraint just to encourage "novel" answers, or are there particular aspects of an SSL/TLS-based approach which make it unacceptable to you?
Sep
19
awarded  Enlightened
Sep
19
awarded  Nice Answer
Sep
14
comment when is it safe to click through an SSL warning message?
For the "name doesn't match" case it often suffices to change the URL to the one specified in the certificate; the admin did test it, just not from every URL/domain name that can be used to reach that server.
Sep
14
comment when is it safe to click through an SSL warning message?
Isn't an HTTPS-with-broken-cert website is also theoretically worse than a plain HTTP website if you have visited it before (even if your use this time is non-confidential browsing, say), because it will have access to HTTPS-only cookies for that domain? (And it could be part of an active attack, as you note.)
Sep
14
comment Online backup : how could encryption and de-duplication be compatible?
Your edit beat my answer to it :-)
Sep
14
answered Online backup : how could encryption and de-duplication be compatible?
Sep
12
comment Most secure password hash algorithm(s)?
You could implement "pick #iters based on time taken" using a library-provided bcrypt -- just time the bcrypt call and if it's "too quick" increase the workload factor and re-try. But are you sure you want that? What if someone deploys your code onto a slow machine (e.g. a small VM) -- you don't want to get too-small work factors as a result. What if your system is left on a "2011" spec machine through to 2019 when all the attackers have 128-way 20GHz boxes? What if the attacker can use a DoS to increase the time your hashing takes? You will at least want a secure-for-now initial work factor.
Sep
1
revised XKCD #936: Short complex password, or long dictionary passphrase?
split out edited-in parts of answer
Sep
1
answered XKCD #936: Short complex password, or long dictionary passphrase?
Sep
1
suggested suggested edit on XKCD #936: Short complex password, or long dictionary passphrase?
Sep
1
revised Flaw in encryption through pseudorandom number stream (from gpg documentation)
linkify eSTREAM
Sep
1
comment Flaw in encryption through pseudorandom number stream (from gpg documentation)
Done. The statement was a too-aggressive interpretation of min("computational complexity of the best known attack", "effective key length") from the columns in the table on the wikipedia page (and removing VEST based on eSTREAM phase 2 finding a practical attack). But you are right, there are too many explicit and implicit question marks over those figures for them to be reliable, and one of the eSTREAM ciphers (MICKEY) isn't even listed. I kept in the references to the specific ciphers to keep the concreteness of the answer, but e.g. HC256, Pike, SEAL and SNOW2 are also contenders.
Sep
1
revised Flaw in encryption through pseudorandom number stream (from gpg documentation)
removed "strongest" claim
Sep
1
comment Can a survey website viewed in Firefox trick the user into sending stored passwords?
(With sufficient rep - 75 points) you can set a bounty on a question (to encourage answers) but not on the act of physical harm to another person (or on any other action outside of stackexchange, for that matter) :-)
Sep
1
comment How to best set up public WiFi without giving access to the rest of my network?
OK. I thought that the OP didn't currently have a public WLAN set up, but did already have the mentioned AP ("wireless router that I've disabled DHCP on and have effectively made into a wireless-wired bridge"), so assumed he'd still need that AP for whatever he was using it for before (e.g. private WLAN, LAN bridging via WLAN, etc.)