82,228 reputation
9114220
bio website
location
age 69
visits member for 3 years, 2 months
seen 23 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Nov
17
answered Stream/block cipher add a simple hash to guarantee integrity
Nov
17
answered What's the typical approach to caching invalid authentication attempts?
Nov
17
answered employing SSL even on non critical web server
Nov
16
awarded  Enlightened
Nov
16
awarded  Nice Answer
Nov
14
comment Accessing iPhone data without passcode - how difficult?
I am not sure it is documented, but it must run on the iPhone hardware within the severe time constraints of the user's patience. So it cannot be that expensive.
Nov
14
comment How to prove Bob has received Alice message
In all of this I am assuming signed receipts, with a signature algorithm that cannot be forged (because both Alice and Bob know each other's public keys).
Nov
14
answered Accessing iPhone data without passcode - how difficult?
Nov
14
answered Real time application of AES and DES
Nov
14
answered How to prove Bob has received Alice message
Nov
14
revised Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?
edited tags
Nov
14
answered Can Fiddler decrypt HTTPS traffic when using elliptic curves + client cert authetication?
Nov
14
awarded  Nice Answer
Nov
13
answered In a browser web server communication, who decides which encryption protocol to use
Nov
13
answered Mechanisms to prevent error propagation in wireless networks with respect to the avalanche effect
Nov
13
comment Machine Certificate Key File Artifacts
Windows stores private keys with encryption, but the encryption is ultimately based on the password of the account that owns the key. If a machine can boot up alone and use a private key, then that machine necessarily "knows" everything that is needed to access the private key, and thus the key can be recovered. That private key encryption is there to defeat some attackers with only partial access (they can read some files, not all of them), to block a few unsophisticated malware that scan RAM brutally, and, of course, to make a show of "having sprinkled crypto everywhere".
Nov
12
comment Security of pronounceable passwords
I'd say that if passwords are hashed with a weak algorithm then you should fix that first. This is only technology -- far easier to do than changing users' minds.
Nov
12
comment Security of pronounceable passwords
40 bits of entropy are not bad, if you use the passwords for, say, user authentication on a server that uses proper password hashing like bcrypt with a high enough iteration count. If the server uses 1 second worth of CPU to check a password, an attacker with 1000 PC will need 15 years on average to crack a password with 40 bits of entropy, which should be enough to deter him.
Nov
12
comment Security of pronounceable passwords
Yes, I have used a minimizing approximation: I have deliberately restricted myself to a subset of "pronounceable passwords", so that I could more easily compute the number of combinations. The subset is still sufficient to make the main point that the number of pronounceable passwords far exceeds the number of existing English words.
Nov
12
answered Security of pronounceable passwords