12,901 reputation
34296
bio website neal.mcburnett.org
location Boulder, CO
age
visits member for 4 years, 6 months
seen 7 hours ago

I like to engage in "Technology Serving Community" via free software.

Consultant, Ubuntu member, Wikipedia contributor since 2002, ElectionAudits developer, Boulder Community Network co-founder, Internet2 consultant for IDtrust, author of pgpstat, Android enthusiast, ex-Bell Labs web/security/standards maven....

See my web site for way more: http://neal.mcburnett.org/


May
17
asked Software Defined Perimeter assumptions, properties, deployment scenarios
Apr
11
asked Examples of “Runtime application self-protection” (RASP) in action?
Mar
29
comment symmetric encryption session keys in SSL/TLS
@Pacerier Good point. I'm not suggesting that the current SSL/TLS design would work if quantum computing broke public key cryptography. I edited the answer.
Mar
29
revised symmetric encryption session keys in SSL/TLS
clarify not a real alternative
Mar
22
awarded  Good Question
Mar
9
awarded  Famous Question
Mar
2
awarded  Nice Answer
Feb
21
comment How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
And then there are the root certs inserted by manufactures like Lenovo, like the crazy one from Superfish which comes with its own insecure CA, including the private key. Get rid of that one also!
Feb
12
awarded  Nice Answer
Feb
1
awarded  Notable Question
Jan
23
awarded  Guru
Dec
22
comment Good password hashing algorithm compatible with PHP and Linux apps
To the folks that think this is a dup - it is not. It is a detailed API question. To resolve it it seems that someone needs to give an example password hashed with current versions of Ubuntu and PHP, and show that hashing it in each leads to something that can be verified on the other.
Dec
20
revised Good password hashing algorithm compatible with PHP and Linux apps
edited title
Dec
20
comment Good password hashing algorithm compatible with PHP and Linux apps
It seems like you've done some interesting research, but also come to some very questionable conclusions. There is a lot of misinformation out there, and of course pbkdf2 and scrypt are supported by lots of systems. Please provide references for your claims of incompatibility, or "problems with bcrypt". Note that password hashing doesn't really require much from a hash function other than being slow, so sha1 or even md5 repeated enough is fine.
Dec
20
reviewed Leave Open Good password hashing algorithm compatible with PHP and Linux apps
Dec
19
comment XKCD #936: Short complex password, or long dictionary passphrase?
Thanks for the pointer! But I think you have a typo there. I'm guessing you're providing a list with 44 bits of entropy, not 64. It starts generating 4-word phrases at 48 bits. And for the record, via for i in {26..81}; do echo -n $i " "; pwqgen random=$i; done: At 26 bits it has 2 word phrases, at 27 it adds punctuation separators, at 31 it has 3 word phrases, with punctuation at 40, at 48 it has 4 word phrases, with punctuation at 53, at 65 it moves to 5 word phrases, with punctuation at 66, all the way up to 81 bits. Seems a bit odd there.
Dec
19
awarded  Custodian
Dec
19
reviewed Close How exactly was Sony Pictures hacked November 2014?
Dec
17
awarded  Popular Question
Dec
16
awarded  Revival