Reputation
678
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 5 12
Newest
 Yearling
Impact
~27k people reached

  • 0 posts edited
  • 1 helpful flag
  • 51 votes cast
Feb
3
comment Why is leaving a passworded SSH over the internet so bad?
"As I understand it, a key is not that different from a password; it is just much, much longer and therefore harder to crack."... no, you are confusing authentication tokens with public/private keys. The entire point of a private key is that, unlike a password, it is never communicated when authenticating. There is a very fundamental difference here.
Feb
1
comment How can I protect myself from false accusations when our company practices password escrow?
Also, there's the question of why should your boss need to access your account in the first place. That's equivalent to saying that he needs to be able to impersonate you, which makes no sense. If he needs to read your files -- he can use an administrator account to read those; he doesn't need to impersonate you in order to do that, unless the files are encrypted with your password, which I suspect not (it would be kind of pointless given the context).
Feb
1
comment How can I protect myself from false accusations when our company practices password escrow?
I would say definitely get a receipt or something for the envelope... but it may be too late now since it might be too awkward to ask him without implicitly telling him you don't trust him. Another possibility is to send someone (if you don't have anyone, yourself) an email or something with the precise date/time when you gave him the envelope and details of what you did... at least later on if it comes to having to prove your case, you can make a (small) case that you're not making the story about the envelope up on the spot.
Jan
30
asked Exactly how bad is using 'mod' to clamp reduce numbers to a given range?
Jan
25
comment Could I recover the content of file from its checksum/hash?
If you actually manage to create a 2 MB chunk that results in a SHA-256 hash that you did not already know to be the result of that chunk, I think the NSA will want to have a word with you.
Jan
21
answered Is it possible to secretly monitor/backdoor hardware?
Jan
15
comment Why didn't OSes securely delete files right from the beginning? And why do they still not do this?
+1 computers weren't originally designed for laymen.
Jan
14
comment Reading physical memory frame previously owned by another process to read contents of its memory page
The physical pages are not zeroed, but rather the memory that you see is mapped to a zeroed page. The pages likely contain all their data until they are committed, which happens on the first write to them unless committed explicitly.
Dec
12
comment Can the root user be removed from a *nix system to prevent privilege-escalation?
@MikeOunsworth: Yeah, exactly. Even if the address of uid was already fixed to a known value it would barely change the story. The point is that it's in protected memory, not that it's in an unknown location.
Dec
12
comment Can the root user be removed from a *nix system to prevent privilege-escalation?
@MikeOunsworth: You make it sound as though the main obstacle attackers face is finding where uid is stored in memory.
Nov
24
comment Writing my own encryption algorithm
@Rich: (1) The assumption that factoring is hard is only "strong" because no one has been able to break it. Why does that imply a new assumption that no one has worked on is weak? (2) What is the assumption that belies the strength of ECC? You keep avoiding answering this.
Nov
24
comment Writing my own encryption algorithm
@Rich: And what about ECC? Also, if you state your assumptions that doesn't make your algorithm more secure. I can come up with an algorithm and state my assumptions too. Does that mean it's secure now? I feel like you're missing my point...
Nov
24
comment Writing my own encryption algorithm
@Rich: "They can prove that breaking RSA is very difficult." ...can you link me to said proof? All it relies on is factorization being difficult; there is no proof behind that. Not sure if you're following the news, but there was a very recent development on a quasi-polynomial-time algorithm for graph isomorphism, and after hearing about it some people are beginning to wonder whether factorization can be solved in quasi-polynomial-time too. Also, can you say the same for ECC? People think ECC is hard because no one has been able to break it either. Is there a proof? No.
Nov
23
comment Writing my own encryption algorithm
@fr00tyl00p: To put it into perspective, I have one hell of hard time believing that ECC is actually secure. It doesn't look like it should be, and it looks like something I could come up with on a weekend since I don't need any proof of hardness or anything whatsoever, just a gut feeling. The one thing I would lack is a good reputation to make people take a similar algorithm seriously, but what else would I lack? I could just claim it's hard and wait for someone to prove me wrong. So why do people consider ECC any more secure than a random algorithm I might come up with?
Nov
23
comment Writing my own encryption algorithm
@fr00tyl00p: Again, I'm not disagreeing with your overall message or conclusion. What I'm disagreeing with is your premise that cryptographers "find reasons why [their algorithm] actually is secure". To the best of my understanding, they really don't do this: the reason comes after the algorithm is already invented, by the fact that it is not broken. Until then, all of it is based on the fact that they just have a gut feeling that their algorithms should be secure, and they don't have any evidence to the contrary. Your answer makes it seem like cryptographers prove uncrackability or something.
Nov
23
comment Writing my own encryption algorithm
@mbrt: By your logic it is impossible to invent a secure encryption algorithm.
Nov
23
comment Writing my own encryption algorithm
Not that I disagree with you overall message, but... "The difficult thing when it comes to cryptography is finding reasons why something actually is secure. You won't be able to decide that within months and if you feel like you are at that point, you are most probably wrong." So do people know why an algorithm like RSA is secure? As far as I'm aware, it's because no one has been able to find a way to break it. So why should a student believe his/her algorithm is any worse?
Nov
22
comment Are SHA-2 certificates considered obsolete, or current?
@TRiG: How else were you interpreting 11/20/2015?
Oct
19
comment Is a VPN really required with free Wi-Fi on a train?
@Begueradj: No, it's not relevant. The threat we're worried about here is MITM, and that's something that requires end-to-end security pretty much by definition.
Oct
19
comment Is a VPN really required with free Wi-Fi on a train?
I literally don't understand why the encryption of the network even comes into play here. It seems totally irrelevant.