279 reputation
210
bio website ablazex.com
location Austin, TX
age 26
visits member for 3 years
seen Apr 30 at 20:42

Sep
5
awarded  Notable Question
Jul
12
awarded  Popular Question
Jan
28
comment How secure is the new Mega-site encryption?
I don't agree with lost password = lost data. That's just the nature of the beast, you can't avoid this when using encryption.
Jan
28
comment How secure is the new Mega-site encryption?
I don't know if it's secure, but for the life of I can't get it to work at all. Sometimes the environment won't load, sometimes it will load but I won't be able to do anything and everything in between. It's a crapshoot.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@ewanm89 I have a high level of paranoia and memorize all passwords to important services (eg: bank accounts, my main email) and store the rest in password manager. So even if my password file is stolen with the key, I wouldn't have too many problems.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
@LucasKauffman Sure, the KeePass database is offline. But what if KeePass is compromised and sends your KDB[X] file and your password over to somewhere?
Jan
17
comment Why Say IP Addresses Are Harmless?
@Ramhound Yes, I imagined that would be the case. But isn't that a technical issue?
Jan
17
comment How far can we go in preventing videos from spreading out using P2P networks like BitTorrent?
@this.josh Although lossless copies are available, the vast majority of the pirated media available is compressed (MP3, x264, etc.). You can get copies with great quality even if you are just exploiting the analog hole. That being said, unconcerned, you say? en.wikipedia.org/wiki/Home_Taping_Is_Killing_Music
Jan
15
comment Why Say IP Addresses Are Harmless?
Interesting. I thought SE escaped potential HTML every tag that's not on their whitelist (<a>, <b>, etc.)
Jan
15
comment Why Say IP Addresses Are Harmless?
(costs... Costs what?
Jan
15
comment Why Say IP Addresses Are Harmless?
"every time you send an email" Gmail doesn't hand out my IP (at least if you're using the web interface). I remember Yahoo used to do it, which is one of the reasons why I stopped using it.
Jan
15
comment Should security question answers be case-sensitive?
This question is being asked from the perspective of someone creating a password recovery scheme, not the end user. The vast majority of people have no idea what password management software is.
Jan
14
comment Brute force login attempt from spoofed IP's
I think the rationale for trusting HTTP_X_FORWARDED_FOR (and HTTP_X_REAL_IP) over $_SERVER['REMOTE_ADDR'], which is the IP of the TCP connection, is because most transparent proxies set those headers. Since it's not really doing any authentication based upon those IPs (at least I hope WP doesn't use any kind of IP-based authentication), I wouldn't go as far as calling it a vulnerability. It's just a question of what is more likely to be the real IP: the TCP IP or the one set in those headers.
Dec
4
comment Two step encryption
@onlineapplab.com The solution is simple: use a different symmetric key for each user. Of course this means you'd have to decrypt data on the server, but I don't see much advantage in not doing so.
Dec
4
comment Two step encryption
@onlineapplab.com Why would that be a problem? You'd still be able to decrypt data stored on the database if you had the original key, right?
Dec
4
revised Two step encryption
based on clarifications in comments made by the OP on question and its answers
Dec
4
suggested suggested edit on Two step encryption
Dec
4
comment Two step encryption
@MarkC.Wallace If I understand the OP correctly, they want to give each user a different private key with which they can decrypt the ciphertext and get the original data back. This also means each user gets a different ciphertext. The result is now users can't share keys. My question to the OP is: in this case, why would they bother sharing the keys, when they can just share the original plaintext?
Dec
4
comment Two step encryption
@onlineapplab.com Why does it matter if different users can share the decryption key? If the user is able to decrypt data, why would they even bother sharing the key? They could just share the decrypted data itself. I understand the question, but the use case is just not there.
Nov
29
comment Does shuffling a hashed password increase its security?
That's a bit of misnomer. If you pay close attention, the manual goes on to say it's a "Blowfish-based hashing algorithm"