87,836 reputation
9121244
bio website
location
age 69
visits member for 3 years, 6 months
seen 2 days ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


May
3
awarded  Nice Answer
May
2
awarded  Nice Answer
May
1
answered Is TLS 1.0 more secure than TLS 1.2?
Apr
29
awarded  Nice Answer
Apr
25
awarded  Nice Answer
Apr
24
revised Please critique my encryption scheme for a very small microcontroller
deleted 1 character in body
Apr
24
answered Please critique my encryption scheme for a very small microcontroller
Apr
24
awarded  Nice Answer
Apr
24
answered Sharing a common public and private SSH keys for a cluster of machines
Apr
24
comment Custom socket server on the internet running as root
"Principle of least privilege" is worth anything only as long as there is some actual difference in the available privileges. My point is that the difference between "root" and "non-root" is usually negligible with today's systems -- it mattered a lot when attackers and victims shared the same hardware and OS instance, and "root" was basically a god; but no longer for separate machines, as in your case.
Apr
23
answered Custom socket server on the internet running as root
Apr
23
answered Why do HTTPS requests include the host name in clear text?
Apr
23
answered Understanding Certificate Pinning
Apr
23
answered How significant is the risk in having someone email/IM an htpasswd hash?
Apr
23
answered Should other processes be running while an iPhone or Android is generating a cryptographically random number?
Apr
23
comment This is 2015. Has SHA1 been exploited or cracked yet?
A compelling reasons for switching to SHA-256 for certificates is that some modern browsers (especially Chrome) are beginning to emit warnings when they see SHA-1 used in the signature of a certificate. Regardless of whether SHA-1 is weak or not, using it incurs the risk of scaring users away (especially when users are prospective customers).
Apr
22
awarded  Nice Answer
Apr
22
comment Why don't we reward users who choose strong passwords?
Well, I don't require users to remember a random password. I suggest it, and I reward them if they do. Writing down passwords is not bad idea, as long as they keep the paper in a safe place (their wallet is not a bad place for that). The real benefit from such a system is not that the password is random; it is that the user will have a distinct password on every site, and passwords for one site cannot be inferred from passwords for the same user on another site. As long as the system enlists user cooperation, and does not try to enforce things, it may work.
Apr
22
answered This is 2015. Has SHA1 been exploited or cracked yet?
Apr
22
answered Why don't we reward users who choose strong passwords?