Reputation
209
Top tag
Next privilege 250 Rep.
View close votes
Badges
1 6
Newest
 Critic
Impact
~6k people reached

  • 0 posts edited
  • 0 helpful flags
  • 25 votes cast
8h
comment What is HiASLR?
@Polynomial So basically if I compile my dlls without /DYNAMICBASE and then force it on via the exe or the registry setting, I get an additional 5 bit entropy for free? How weird. Why? Backcomp seems unlikely (any dll that can handle 19bit ASLR should work with 24bit too).
8h
comment What is HiASLR?
I'm wondering what is meant with Non-ASLR DLL images - why do they get more entropy than DLL images (which are presumably those which have the ASLR flag set?)?
Aug
29
comment How does a hacker know how many times a password was hashed?
@Hobbs didn't know that you couldn't do that with bcrypt - was assuming it'd be similar to PBKDF2. Yep in that case you need the additional complexity in your login process and have to store some additional information in the db, might as well be the iteration count.
Aug
28
comment How does a hacker know how many times a password was hashed?
"However, it is more difficult to up this in future than it is when storing with each separate password" - not really. I mean you want to update everybody to the higher iteration count immediately anyhow and not just whenever they change their password, so you will want to do it in one go anyhow. In the end that's just taking the hashed password and applying the hashing algorithm a few more rounds, storing the iteration count is not really useful there, but then as long as the user can create their own account also doesn't cost you anything.
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@Cort Definitely. It's not the right option in every situation (and it really depends how you do it as you point out). I just find that it gets bashed way too often and for the wrong reasons, since for many practical purposes it's the best security your layman will be able to achieve.
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@Paul Hardware keyloggers exist and are incredibly cheap and quick and easy to install. And that's just the easiest of many available options. Look up all the evil maid attacks. There's a reason why security 101 says if the attacker has physical access to your machine you've lost.
Jul
12
awarded  Critic
Jul
12
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
So what about people writing down their password in their day planners? To get access to those someone has to gain undisturbed access to the work place. If you're able to do that it's game over - it takes less time to install a keylogger (hardware not software if we want to be quick) than to find a password in a day planner. This is rule 101 of computer security: If the hardware is compromised you've lost. For most workplaces writing down passwords is a great option and probably about as safe as one can get.
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
If the only rule really is "at least 7 characters" I think we can all agree that the amount of trivial dictionary words will be exceedingly high. And since we know that one of those is about as secure as 4 random alphanumeric letters (I'm really generous there) why not accept those too? Accepting one really bad password but not the other is rather unfair. Personally I'm all for people writing down their complex passwords for online systems - generally everybody who can get that much physical access to steal one of those scraps of paper could just as easily install a keylogger anyhow.
Sep
8
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
"ATM and TPV outside USA and UE are still missing the chip reader and even inside those countries most ATM are old and would still read only magnetic strips." - card readers using magnetic strips are pretty much unheard of in Europe. I guess that has to do with liability issues. Also I'm pretty sure I only used pin + chip in China.
Jul
10
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@PTwr The NSA certainly uses vast amounts ASICs with fixed hardware that can do nothing but SHA1 (or MD5,..) in parallel. If you think a GPU is fast, just imagine something several orders of magnitudes faster with rather reasonable power consumption. Proof for how easy something like this is even for normal people are all those VLSI bitcoin miners out there. SHA1 with PBKDF2 is only a bandaid there, what you really want is something like scrypt that's designed to take lots of resources.
May
28
comment Is it good practice to ban an IP address if too many login attempts are made from it?
@Roy If the initial sequence number is predictable, the whole handshake is predictable. But apparently that did get better over the years. But see here for what I meant.
May
27
comment Is it good practice to ban an IP address if too many login attempts are made from it?
Don't forget the simple fact that I can easily (sadly really) spoof my IP address and get you to block IPs despite not having any access to it. Depending on your use case such a DDOS attack may be problematic or not.
May
23
comment Are random URLs a safe way to protect profile photos?
@Basic The definition of a secure cryptosystem hasn't changed since the 19th century (Kerckhoff's principle). It is secure if everything but the key is public knowledge. The key in our case is the URL. If I can increase my chances of getting to a file immensely just by having some good guess about when it was created (or creating a few files myself and observing the pattern to figure out the seed of the non-secure PNRG, then I can iterate through all files in the system!), the system is not secure. I just don't see the point of contention here.
May
21
comment Are random URLs a safe way to protect profile photos?
@Basic Umn.. have you actually checked how GUIDs/UUIDs are generated? That math assumes that all bits are randomly generated by a secure random generator which is completely wrong. That guy is basically computing the chances for a collision assuming a non-malicious hacker, which is completely different. For example type 4 UUIDs are generated usually using a non-secure random generator. After seeing some generated UUIDs it's then very, very simple to guess the sequence. The GUIDs based on a MAC are generated using a timestamp - you really don't see how easy it is to guess possible values?
May
21
awarded  Commentator
May
21
comment Are random URLs a safe way to protect profile photos?
@Basic If the problem is "make URLs unguessable" then no there's no much bigger problem than "system makes URLs trivially guessable" (otherwise why not argue that sequential numbers are fine too?). And yes some UUIDs use parts of a MAC address that obviously helps exactly until the attacker can get a single GUID (which is pretty much guaranteed), afterwards it's a simple timestamp they have to guess. Your claim that it would take an "attacker with no knowledge of your system" years to find a collision is just plain wrong.
May
21
comment Are random URLs a safe way to protect profile photos?
@basic there are lots of different kinds of uuids and no there's absolutely no reason for the attacker having to know your system for any of those to be vulnerable - particularly not for type 4 UUIDs...
May
21
awarded  Yearling
May
21
awarded  Nice Answer