Reputation
304
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 10
Impact
~22k people reached

Mar
24
comment openssl: recover key and IV by passphrase
@neubert See my answer. The first 16 bytes are actually derived using PBKDF1 as defined in PKCS#5 v1.5. The next 16 bytes would be MD5(PBKDF1(PASSWORD, SALT) || PASSWORD || SALT) and the IV would be MD5(MD5(PBKDF1(PASSWORD, SALT) || PASSWORD || SALT) || PASSWORD || SALT)
Mar
16
comment openssl: recover key and IV by passphrase
@sarnold Backwards compatibility. Unfortunately there's no way you can ask get it to use a different KDF short of providing the key and the IV
Mar
16
answered openssl: recover key and IV by passphrase
May
22
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Iszi It's a trade-off. If I lose my password database then all my accounts are compromised. If a bank is breached and my account is compromised, then it's only one account. Less hassle for me.
May
22
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@Iszi That's less of a concern because if there is a security breach at my bank it will be in their best interests to ensure their customers are not affected (ie: it would be their fault instead of mine)
Oct
3
awarded  Good Question
Sep
5
awarded  Notable Question
Jul
12
awarded  Popular Question
Jan
28
comment How secure is the new Mega-site encryption?
I don't agree with lost password = lost data. That's just the nature of the beast, you can't avoid this when using encryption.
Jan
28
comment How secure is the new Mega-site encryption?
I don't know if it's secure, but for the life of I can't get it to work at all. Sometimes the environment won't load, sometimes it will load but I won't be able to do anything and everything in between. It's a crapshoot.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@ewanm89 I have a high level of paranoia and memorize all passwords to important services (eg: bank accounts, my main email) and store the rest in password manager. So even if my password file is stolen with the key, I wouldn't have too many problems.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@LucasKauffman Sure, the KeePass database is offline. But what if KeePass is compromised and sends your KDB[X] file and your password over to somewhere?
Jan
17
comment Why Say IP Addresses Are Harmless?
@Ramhound Yes, I imagined that would be the case. But isn't that a technical issue?
Jan
17
comment How far can we go in preventing videos from spreading out using P2P networks like BitTorrent?
@this.josh Although lossless copies are available, the vast majority of the pirated media available is compressed (MP3, x264, etc.). You can get copies with great quality even if you are just exploiting the analog hole. That being said, unconcerned, you say? en.wikipedia.org/wiki/Home_Taping_Is_Killing_Music
Jan
15
comment Why Say IP Addresses Are Harmless?
Interesting. I thought SE escaped potential HTML every tag that's not on their whitelist (<a>, <b>, etc.)
Jan
15
comment Why Say IP Addresses Are Harmless?
(costs... Costs what?
Jan
15
comment Why Say IP Addresses Are Harmless?
"every time you send an email" Gmail doesn't hand out my IP (at least if you're using the web interface). I remember Yahoo used to do it, which is one of the reasons why I stopped using it.
Jan
15
comment Should security question answers be case-sensitive?
This question is being asked from the perspective of someone creating a password recovery scheme, not the end user. The vast majority of people have no idea what password management software is.
Jan
14
comment Brute force login attempt from spoofed IP's
I think the rationale for trusting HTTP_X_FORWARDED_FOR (and HTTP_X_REAL_IP) over $_SERVER['REMOTE_ADDR'], which is the IP of the TCP connection, is because most transparent proxies set those headers. Since it's not really doing any authentication based upon those IPs (at least I hope WP doesn't use any kind of IP-based authentication), I wouldn't go as far as calling it a vulnerability. It's just a question of what is more likely to be the real IP: the TCP IP or the one set in those headers.
Dec
4
comment Two step encryption
@onlineapplab.com The solution is simple: use a different symmetric key for each user. Of course this means you'd have to decrypt data on the server, but I don't see much advantage in not doing so.