209 reputation
16
bio website
location
age
visits member for 3 years, 10 months
seen 2 days ago

Jul
13
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@slicedtoad Hanlon's razor
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@Cort Definitely. It's not the right option in every situation (and it really depends how you do it as you point out). I just find that it gets bashed way too often and for the wrong reasons, since for many practical purposes it's the best security your layman will be able to achieve.
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@Paul Hardware keyloggers exist and are incredibly cheap and quick and easy to install. And that's just the easiest of many available options. Look up all the evil maid attacks. There's a reason why security 101 says if the attacker has physical access to your machine you've lost.
Jul
12
awarded  Critic
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
So what about people writing down their password in their day planners? To get access to those someone has to gain undisturbed access to the work place. If you're able to do that it's game over - it takes less time to install a keylogger (hardware not software if we want to be quick) than to find a password in a day planner. This is rule 101 of computer security: If the hardware is compromised you've lost. For most workplaces writing down passwords is a great option and probably about as safe as one can get.
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
If the only rule really is "at least 7 characters" I think we can all agree that the amount of trivial dictionary words will be exceedingly high. And since we know that one of those is about as secure as 4 random alphanumeric letters (I'm really generous there) why not accept those too? Accepting one really bad password but not the other is rather unfair. Personally I'm all for people writing down their complex passwords for online systems - generally everybody who can get that much physical access to steal one of those scraps of paper could just as easily install a keylogger anyhow.
Sep
8
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
"ATM and TPV outside USA and UE are still missing the chip reader and even inside those countries most ATM are old and would still read only magnetic strips." - card readers using magnetic strips are pretty much unheard of in Europe. I guess that has to do with liability issues. Also I'm pretty sure I only used pin + chip in China.
Jul
10
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@PTwr The NSA certainly uses vast amounts ASICs with fixed hardware that can do nothing but SHA1 (or MD5,..) in parallel. If you think a GPU is fast, just imagine something several orders of magnitudes faster with rather reasonable power consumption. Proof for how easy something like this is even for normal people are all those VLSI bitcoin miners out there. SHA1 with PBKDF2 is only a bandaid there, what you really want is something like scrypt that's designed to take lots of resources.
May
28
comment Is it good practice to ban an IP address if too many login attempts are made from it?
@Roy If the initial sequence number is predictable, the whole handshake is predictable. But apparently that did get better over the years. But see here for what I meant.
May
27
comment Is it good practice to ban an IP address if too many login attempts are made from it?
Don't forget the simple fact that I can easily (sadly really) spoof my IP address and get you to block IPs despite not having any access to it. Depending on your use case such a DDOS attack may be problematic or not.
May
23
comment Are random URLs a safe way to protect profile photos?
@Basic The definition of a secure cryptosystem hasn't changed since the 19th century (Kerckhoff's principle). It is secure if everything but the key is public knowledge. The key in our case is the URL. If I can increase my chances of getting to a file immensely just by having some good guess about when it was created (or creating a few files myself and observing the pattern to figure out the seed of the non-secure PNRG, then I can iterate through all files in the system!), the system is not secure. I just don't see the point of contention here.
May
21
comment Are random URLs a safe way to protect profile photos?
@Basic Umn.. have you actually checked how GUIDs/UUIDs are generated? That math assumes that all bits are randomly generated by a secure random generator which is completely wrong. That guy is basically computing the chances for a collision assuming a non-malicious hacker, which is completely different. For example type 4 UUIDs are generated usually using a non-secure random generator. After seeing some generated UUIDs it's then very, very simple to guess the sequence. The GUIDs based on a MAC are generated using a timestamp - you really don't see how easy it is to guess possible values?
May
21
awarded  Commentator
May
21
comment Are random URLs a safe way to protect profile photos?
@Basic If the problem is "make URLs unguessable" then no there's no much bigger problem than "system makes URLs trivially guessable" (otherwise why not argue that sequential numbers are fine too?). And yes some UUIDs use parts of a MAC address that obviously helps exactly until the attacker can get a single GUID (which is pretty much guaranteed), afterwards it's a simple timestamp they have to guess. Your claim that it would take an "attacker with no knowledge of your system" years to find a collision is just plain wrong.
May
21
comment Are random URLs a safe way to protect profile photos?
@basic there are lots of different kinds of uuids and no there's absolutely no reason for the attacker having to know your system for any of those to be vulnerable - particularly not for type 4 UUIDs...
May
21
awarded  Yearling
May
21
awarded  Nice Answer
May
20
comment Are random URLs a safe way to protect profile photos?
@WGroleau It should be pointed out that in that link all the given examples are of systems that are in one way or another broken. None of the broken systems used a large search space combined with a secure random generator. I mean really.. sequential URLs? So I find that less applicable than the given link which shows an inherent flaw in the system (for some uses only) and not just problems with broken implementations. Although it shows that people will try to exploit such a system so better make sure it's sound!
May
19
comment Are random URLs a safe way to protect profile photos?
@owenfi In that case I think we can consider this reasonably safe assuming you use a large enough address space and a secure random algorithm to create the URL.
May
19
awarded  Teacher