1,424 reputation
716
bio website
location
age
visits member for 3 years, 1 month
seen May 20 '12 at 21:36

Sep
1
comment How to best set up public WiFi without giving access to the rest of my network?
OK. I thought that the OP didn't currently have a public WLAN set up, but did already have the mentioned AP ("wireless router that I've disabled DHCP on and have effectively made into a wireless-wired bridge"), so assumed he'd still need that AP for whatever he was using it for before (e.g. private WLAN, LAN bridging via WLAN, etc.)
Aug
31
comment Flaw in encryption through pseudorandom number stream (from gpg documentation)
Just having to have seen 624 of the random words (19937 bits) would be bad enough. I suspect that if you know that the MT19937 state had been initialised from a 256-bit seed just prior to use then it could reduce the difficulty even further.
Aug
31
answered Flaw in encryption through pseudorandom number stream (from gpg documentation)
Aug
31
comment What is the difference between authenticity and non-repudiation
Another example: OTR (cypherpunks.ca/otr) is designed specifically to provide authentication but no repudiation -- deniability is an explicit design goal.
Aug
31
comment How would you store a 4 digit pin code securely in the database?
Your analysis in para 1 seems to assume that an attacker who "gets a dump the database" has access to everything on the server which is used to verify the PIN. SQL injection and priv-escalation vulns are quite distinct (and its probably rare for SQL injection to be bad enough to provide a platform for OS-level priv escalation), which makes this untrue in general, I think.
Aug
31
answered How would you store a 4 digit pin code securely in the database?
Aug
31
answered Brute-force heuristics used in password cracking
Aug
30
comment Brute-force heuristics used in password cracking
I believe J-t-R does use statistical (digraph frequencies) techniques to prioritise cracking efforts, as do other similar tools. There are sites for the specific purpose of sharing stolen/leaked password hashes (whether salted or not) and the corresponding cracked passwords. (Salting slows progress, but even with salting MD5 is susceptible to brute-forcing with GPGPUs -- particularly for <9 chars and/or letters-only -- and there are several tools that use GPGPUs to accelerate the cracking attempts. JtR can use substitution patterns (e.g. l33t) as well as wordlists and digraph frequencies.
Aug
30
revised Passwords - any statistics on user behavior?
added another reference
Aug
30
revised Passwords - any statistics on user behavior?
added another reference
Aug
30
revised Passwords - any statistics on user behavior?
added link
Aug
30
answered Passwords - any statistics on user behavior?
Aug
29
comment Applying file deltas to an encrypted file
What are the constraints, more precisely? Does "the network will be saturated sending deltas is preferred" mean that the network is saturated "up" (writes from clients to server) or "down" (reads) or both? Does "the client [might] not have version control" mean that the client may not keep a copy of the "previous version" of the file (which would allow it to calculate the delta itself)? Is it acceptable for the client to run any custom software at all, or must the server present a standard file server interface (NFS/CIFS/WebDAV/sftp/whatever) suitable for direct usage by the end-user?
Aug
29
comment Applying file deltas to an encrypted file
In "Files will be decrypted, have the delta applied, then re-encrypted" do you mean "the [VCS] file [containing the previous version(s) of the end-user file] will be decrypted, the delta to the new version of the end-user file calculated, the delta appended to the [VCS] file, and the [VCS] file re-encrypted"? Which bit of that "sounds a bit inefficient" -- the de/re-encryption of the VCS file?
Aug
29
revised Best password strength checker
typo
Aug
29
comment How to best set up public WiFi without giving access to the rest of my network?
$50 was NIC + the second "public" AP. Which might still be an overestimate -- I'm not in the US.
Aug
29
answered Best password strength checker
Aug
29
awarded  Supporter
Aug
29
awarded  Scholar
Aug
29
awarded  Commentator