2,375 reputation
1215
bio website
location
age
visits member for 4 years, 1 month
seen Nov 4 '11 at 15:09

Jun
20
comment How can we accurately measure a password entropy range?
One of the mathematically cool things about true randomness is that you can't measure it accurately. Because the kolmogorov complexity of a string is noncomputable, you can never say how random a string is. All you can say is how random a string isn't, based on the best compression of it you've found so far.
Jun
16
answered Encryption strategies for multi users access in production systems
Jun
10
comment Resolving an IP address of a Remote machine to its MAC address
If the other computer is an old enough Windows machine (XP era), and ports 139 & 445 aren't blocked anywhere along the route, you can get the MAC address with a netbios query. It'd be rare to find something that unsecured in the wild, though.
Jun
8
comment Is there a digital “safety deposit box” equivalent?
Are you thinking of something like a GPG encrypted file on your own computer? Or more like tarsnap, for secure backups?
Jun
7
comment Sony Attacks, what would you do?
I agree; it's too early for Sony to start applying technology to the problem. They need to identify their assets, vulnerabilities, and threats. They should be spending millions of dollars ASAP on the best team of internal and external auditors money can hire.
Jun
7
comment Security implications of storing the password hash along an encrypted AES key
Norman, when you say "password hash for authentication purpose," that's not just a single iteration of a hashing algorithm, is it?
Jun
7
comment Security implications of storing the password hash along an encrypted AES key
If Norman were dumb enough to store his password as an md5 or SHA1/256/512 hash, that would be a big concern. Fortunately, however, Norman isn't that stupid--he's implementing a well-reviewed crypto standard. This crypto standard knows about GPGPU, so instead of simply hashing, it calls for a minimum of 1000 iterations of the hashing function. This, in the words of the PKCS#5 standard, "will increase the cost of exhaustive search for passwords significantly." Still not as good as bcrypt, with its tunable work factor (or scrypt, with memory-hard tuning), but it's better than naively hashing.
May
26
awarded  Critic
May
26
comment How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
That's a good method, and it's the one that actually gets used in the real world. A password history/complexity enforcer could also check against an arbitrary number of historical passwords by hashing variants and derivations when a user first sets the password, and storing those to check against later.
May
25
awarded  Enlightened
May
25
awarded  Nice Answer
Apr
6
comment Doubling up or cycling encryption algorithms
Good answer. If you do it wrong, repeating an algorithm can actually weaken the encryption. If you do it right, it's called Key Stretching: en.wikipedia.org/wiki/Key_stretching
Mar
29
comment Snort's great, but BASE isn't. What are some alternative front-ends?
Snorby seems to depend on versions of other programs more recent than are included in common distros' package managers. When the program is also one that's a severe dependency hell to install from source, like ImageMagick, this presents a bit of a barrier to entry. Insta-snorby is nice, but doesn't come in 64 bits, so I'm stuck back with BASE again :(
Mar
27
awarded  Necromancer
Mar
25
comment How would I implement “Broadcast Encryption”?
If there's other features you might eventually want, like deterring people who might share keys, you should skim an overview of the Broadcast Encryption field such as this paper: math.scu.edu/~jhorwitz/pubs/broadcast.pdf
Mar
24
answered How reliable is a password strength checker?
Mar
23
answered Is Skype secure enough to transmit passwords?
Feb
22
comment Snort's great, but BASE isn't. What are some alternative front-ends?
At work, I need special dispensation to install anything besides IE7. After getting that dispensation (and firefox) both demo.snorby.org and the local insta-snorby experiment seem to work perfectly. It certainly makes sense not to deal with the IE headache when developing a webapp, but a failover message about IE nonsupport on the default page would be cool.
Feb
17
answered What tools exist to manage large scale firewall rulesets?
Feb
17
comment Do mobile OS's provide crypto-quality randomness?
In iOS, the Certificate, Key, and Trust Services API provides crypto services, but not cryptographic primitives as low-level as strong psuedorandom numbers. The full CDSA API available in OSX does, but on the iPhone you're going to have to either DIY or make Thomas Ptacek happy and Don't Implement Crypto.