80,938 reputation
9111216
bio website
location
age 69
visits member for 3 years, 1 month
seen 7 hours ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Nov
14
comment Accessing iPhone data without passcode - how difficult?
I am not sure it is documented, but it must run on the iPhone hardware within the severe time constraints of the user's patience. So it cannot be that expensive.
Nov
14
comment How to prove Bob has received Alice message
In all of this I am assuming signed receipts, with a signature algorithm that cannot be forged (because both Alice and Bob know each other's public keys).
Nov
13
comment Machine Certificate Key File Artifacts
Windows stores private keys with encryption, but the encryption is ultimately based on the password of the account that owns the key. If a machine can boot up alone and use a private key, then that machine necessarily "knows" everything that is needed to access the private key, and thus the key can be recovered. That private key encryption is there to defeat some attackers with only partial access (they can read some files, not all of them), to block a few unsophisticated malware that scan RAM brutally, and, of course, to make a show of "having sprinkled crypto everywhere".
Nov
12
comment Security of pronounceable passwords
I'd say that if passwords are hashed with a weak algorithm then you should fix that first. This is only technology -- far easier to do than changing users' minds.
Nov
12
comment Security of pronounceable passwords
40 bits of entropy are not bad, if you use the passwords for, say, user authentication on a server that uses proper password hashing like bcrypt with a high enough iteration count. If the server uses 1 second worth of CPU to check a password, an attacker with 1000 PC will need 15 years on average to crack a password with 40 bits of entropy, which should be enough to deter him.
Nov
12
comment Security of pronounceable passwords
Yes, I have used a minimizing approximation: I have deliberately restricted myself to a subset of "pronounceable passwords", so that I could more easily compute the number of combinations. The subset is still sufficient to make the main point that the number of pronounceable passwords far exceeds the number of existing English words.
Nov
10
comment How bad is it to truncate a hash?
It is possible to define quite contrived hash functions that show how resistances to preimages, second preimages and collisions are distinct concepts. However, if you resist collisions then you resist second preimages at least as well (though you normally expect a much better resistance for second preimages than for collisions).
Nov
10
comment How bad is it to truncate a hash?
@NWard: for a collision, you challenge the attacker with finding two distinct inputs that hash to the same value. For a second preimage, you issue the same challenge with the additional constraint that you fix one of the two messages that are to collide. (So it makes sense that finding a second preimage is harder than finding a collision.)
Nov
10
comment How can I check the integrity of the downloaded files?
"Integrity" does not mean "the file is nice and innocuous". Integrity is about making sure that a given file is exactly the same as it was at its source. It says nothing about the trustworthiness of the source; only that the file was not altered in transit.
Nov
9
comment Avast https scanning
A tool that does a MitM can remove the Public-Key-Pins headers to prevent pinning from happening, or, alternatively, register its own fake certificates as pins. However, it can be expected that things will break for servers for which pinning was active before installation of Avast. Conceptually, Avast could try to empty the current cache of pinned keys upon installation (or deactivate pinning altogether), but I am not sure there is an API for that; I don't know if Avast bothers doing it.
Nov
9
comment Is publishing CRLs over HTTP a potential vulnerability?
A CRL contains a field called thisUpdate that documents its age. It also contains a (theoretically optional, but in practice always there) field called nextUpdate that specifies a date at which a newer CRL will be available; all implementations use nextUpdate as a CRL expiration date.
Nov
7
comment Completely disabling microphone
Technically no, you cannot trust that. If it can be done from software (BIOS is just software) then it can be undone in software.
Nov
6
comment Indexing encrypted data for efficient searching
"Padding with a secret value before hashing" really means computing a MAC, so you may as well do it correctly. Use HMAC, which is a deterministic MAC. Using HMAC to generate a search key is equivalent to the "deterministic encryption" solution, except that it uses up an extra column (in particular, if you can search the MAC values then you still leak whether two source values are identical or not).
Nov
6
comment How to mitigate the risk of X forwarding?
@SiyuanRen: yes, this would be similar.
Nov
5
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
@user2813274: there are products that do interception of SSL traffic by generating on the fly a fake certificate and, technically, doing a MitM attack (this of course requires installation of the corresponding CA certificate in the clients). However, this may incur substantial CPU cost on the firewall/filter side, and it breaks client certificates (although this are quite rare in practice).
Nov
4
comment What would HTTP/2 TLS encryption provide?
The text means that some people insist on being formally allowed to do some HTTP/2 over plain TCP without a TLS layer. However, Firefox and Chrome already decided not to support non-TLS HTTP/2, so life will be hard for sites that use HTTP/2 without TLS. Hence my "somehow mandatory".
Nov
4
comment In OpenVPN, is the dh1024.pem file dependent on the CA?
You should be able to replace it at any time, although you must probably restart the server software to make it take the new file into account. OpenVPN uses a TLS handshake for each new client, and the DH parameters are used by the server (and sent to the client) during that handshake. However, there is little point in changing the file; you can, but there is no known security issue that such a change would solve.
Oct
31
comment Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?
Arguably, if the K_D key is document-specific, then sharing the key and the document are the same thing. One could say that you cannot force somebody to forget a document any more than you can force him to forget a key. In that sense, "revoking" an access is not well-defined.
Oct
30
comment Why are drives overwritten three times when being disposed of?
But 20 years ago, indeed we were not using Flash drives... However, even for magnetic drives, remanence has reduced a lot because information density has increased; so when the drive is writing a "1" it already gets something in the 0.6 to 1.8 range or something like that. The small differences that remanence relies upon have been exploited to store more bytes in the disk. That's how we get disks with terabytes of data nowadays.
Oct
29
comment How to deal with password schemes that can produce weak passwords?
Analogies usually break down when looked at to closely. I don't claim that the bus is a metaphor for passwords; it is only an illustration that we all use probabilistic decisions in all aspects of our lives, so passwords should be no exception.