1,469 reputation
816
bio website
location
age
visits member for 3 years, 4 months
seen May 20 '12 at 21:36

Jan
14
comment Best password strength checker
I like the KC idea, but unfortunately, KC is not computable (see en.wikipedia.org/wiki/…), whatever the string length. Compression algorithms provide an upper bound on KC - the trick is to choose a good compression algorithm. We'd want the algorithm to "know" all the dictionary words, as well as how to make l33t, suffixed, etc. combinations. That algorithm is basically JtR, isn't it, where the compressed result is the index in the list of attempted passwords?
Jan
14
comment Best password strength checker
But (like most of the others) any l33t-speak defeats its "common passwords" list, and it also doesn't use diagraph/trigraph frequencies for "english-like" character sequences.
Jan
12
comment How to demo a new 0-day security product?
Sure -- "reasonable argument" and "compelling demo" are far from being synonyms. Depends on your audience -- some will be impressed by animated powerpoints, others by a thorough exposition of the approach used. YMMV
Sep
22
comment How to properly encrypt a communication channel between a client and a server (without SSL)?
Why are you trying to create your own protocol, rather than using an existing one? Is the "no SSL" constraint just to encourage "novel" answers, or are there particular aspects of an SSL/TLS-based approach which make it unacceptable to you?
Sep
14
comment when is it safe to click through an SSL warning message?
For the "name doesn't match" case it often suffices to change the URL to the one specified in the certificate; the admin did test it, just not from every URL/domain name that can be used to reach that server.
Sep
14
comment when is it safe to click through an SSL warning message?
Isn't an HTTPS-with-broken-cert website is also theoretically worse than a plain HTTP website if you have visited it before (even if your use this time is non-confidential browsing, say), because it will have access to HTTPS-only cookies for that domain? (And it could be part of an active attack, as you note.)
Sep
14
comment Online backup : how could encryption and de-duplication be compatible?
Your edit beat my answer to it :-)
Sep
12
comment Most secure password hash algorithm(s)?
You could implement "pick #iters based on time taken" using a library-provided bcrypt -- just time the bcrypt call and if it's "too quick" increase the workload factor and re-try. But are you sure you want that? What if someone deploys your code onto a slow machine (e.g. a small VM) -- you don't want to get too-small work factors as a result. What if your system is left on a "2011" spec machine through to 2019 when all the attackers have 128-way 20GHz boxes? What if the attacker can use a DoS to increase the time your hashing takes? You will at least want a secure-for-now initial work factor.
Sep
1
comment Flaw in encryption through pseudorandom number stream (from PGP documentation)
Done. The statement was a too-aggressive interpretation of min("computational complexity of the best known attack", "effective key length") from the columns in the table on the wikipedia page (and removing VEST based on eSTREAM phase 2 finding a practical attack). But you are right, there are too many explicit and implicit question marks over those figures for them to be reliable, and one of the eSTREAM ciphers (MICKEY) isn't even listed. I kept in the references to the specific ciphers to keep the concreteness of the answer, but e.g. HC256, Pike, SEAL and SNOW2 are also contenders.
Sep
1
comment Can a survey website viewed in Firefox trick the user into sending stored passwords?
(With sufficient rep - 75 points) you can set a bounty on a question (to encourage answers) but not on the act of physical harm to another person (or on any other action outside of stackexchange, for that matter) :-)
Sep
1
comment How to best set up public WiFi without giving access to the rest of my network?
OK. I thought that the OP didn't currently have a public WLAN set up, but did already have the mentioned AP ("wireless router that I've disabled DHCP on and have effectively made into a wireless-wired bridge"), so assumed he'd still need that AP for whatever he was using it for before (e.g. private WLAN, LAN bridging via WLAN, etc.)
Aug
31
comment Flaw in encryption through pseudorandom number stream (from PGP documentation)
Just having to have seen 624 of the random words (19937 bits) would be bad enough. I suspect that if you know that the MT19937 state had been initialised from a 256-bit seed just prior to use then it could reduce the difficulty even further.
Aug
31
comment What is the difference between authenticity and non-repudiation
Another example: OTR (cypherpunks.ca/otr) is designed specifically to provide authentication but no repudiation -- deniability is an explicit design goal.
Aug
31
comment How would you store a 4 digit pin code securely in the database?
Your analysis in para 1 seems to assume that an attacker who "gets a dump the database" has access to everything on the server which is used to verify the PIN. SQL injection and priv-escalation vulns are quite distinct (and its probably rare for SQL injection to be bad enough to provide a platform for OS-level priv escalation), which makes this untrue in general, I think.
Aug
30
comment Brute-force heuristics used in password cracking
I believe J-t-R does use statistical (digraph frequencies) techniques to prioritise cracking efforts, as do other similar tools. There are sites for the specific purpose of sharing stolen/leaked password hashes (whether salted or not) and the corresponding cracked passwords. (Salting slows progress, but even with salting MD5 is susceptible to brute-forcing with GPGPUs -- particularly for <9 chars and/or letters-only -- and there are several tools that use GPGPUs to accelerate the cracking attempts. JtR can use substitution patterns (e.g. l33t) as well as wordlists and digraph frequencies.
Aug
29
comment Applying file deltas to an encrypted file
What are the constraints, more precisely? Does "the network will be saturated sending deltas is preferred" mean that the network is saturated "up" (writes from clients to server) or "down" (reads) or both? Does "the client [might] not have version control" mean that the client may not keep a copy of the "previous version" of the file (which would allow it to calculate the delta itself)? Is it acceptable for the client to run any custom software at all, or must the server present a standard file server interface (NFS/CIFS/WebDAV/sftp/whatever) suitable for direct usage by the end-user?
Aug
29
comment Applying file deltas to an encrypted file
In "Files will be decrypted, have the delta applied, then re-encrypted" do you mean "the [VCS] file [containing the previous version(s) of the end-user file] will be decrypted, the delta to the new version of the end-user file calculated, the delta appended to the [VCS] file, and the [VCS] file re-encrypted"? Which bit of that "sounds a bit inefficient" -- the de/re-encryption of the VCS file?
Aug
29
comment How to best set up public WiFi without giving access to the rest of my network?
$50 was NIC + the second "public" AP. Which might still be an overestimate -- I'm not in the US.
Aug
29
comment Pre-hash password before applying bcrypt to avoid restricting password length
... and luckily (or by design?) 64 or 128 bits (8 or 16 characters) of random salt with the 256 bits (32 characters) sha256(password) output does fit within the 55 char bcrypt() limit. Thanks.
Aug
29
comment Pre-hash password before applying bcrypt to avoid restricting password length
Thanks, now fixed