meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years, 5 months |
| seen | Mar 3 at 0:19 | |
| stats | profile views | 8 |
Java is my favorite programming language, but python is a close second. I like to play with math and cryptography as well.
|
Aug 21 |
awarded | Caucus |
|
Aug 21 |
awarded | Constituent |
|
Jan 21 |
comment |
Do spaces in a passphrase really add any more security/entropy? @drjimbob: When let me in becomes a possibility as well as letmein entropy has increased by definition. |
|
Jan 21 |
comment |
Do spaces in a passphrase really add any more security/entropy? This is incorrect. Spaces do add entropy to any real password/pass phrase system. And your parenthesized comment admits it. |
|
Dec 3 |
comment |
How to roll my own security mechanism - avoid SSL It is also not a programming question. |
|
Aug 20 |
awarded | Commentator |
|
Aug 20 |
comment |
How would one fully protect himself against man in the middle-attacks? @Filip Haglund: It doesn't matter when the MiTM starts, it will be detected when the peers attempt authentication. |
|
Aug 20 |
comment |
How would one fully protect himself against man in the middle-attacks? @Flip Haglund: Either you're not paying attention or you don't understand the authentication model used by TLS. The user would detect the MiTM trying to pretend to be the server. |
|
Jul 8 |
comment |
Paypal IPN, SSL and man-in-the-middle attacks @nealmcb: I disagree, and further @EJP's second sentence of his two sentence answer is all about doing the trust checking correctly. I fail to see any way to read into his correct statement about blocking MITM attacks an endorsement of one-sided authentication. If the service running on the SSL server needs to authenticate the client it will surely do so, probably with a usename and password rather than SSL's client authentication feature. |
|
Jun 21 |
comment |
Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed? The only reason to compute a rainbow table is to reuse the effort to compute the table. The cost of computing the table is slightly more than the cost of trying all the possible passwords that the table covers. A salt eliminates the benefit of the rainbow table because every password entry has a different salt. |
|
Jun 21 |
comment |
Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed? This is incorrect and reflects a misunderstanding of rainbow tables and salts. |
|
Mar 2 |
comment |
Should RSA public exponent be only in {3, 5, 17, 257 or 65537} due to security considerations? Very well said. IIRC, at some point in its many incarnations, PGP used to generate a random 16 bit public exponent during key generation. |
|
Dec 16 |
awarded | Critic |
|
Dec 12 |
comment |
Forced into using a static IV (AES) @AviD: No, it is completely accurate, the only attacks with static IVs are the ones listed in this answer. And the AES blocksize is not configurable. It is 16 bytes. |
|
Dec 11 |
comment |
Do secure phone lines exist? This seems unlikely as it would require every household to have a secure phone and, more importantly, would require nationwide key management. |
|
Dec 10 |
awarded | Teacher |
|
Dec 10 |
awarded | Supporter |
|
Dec 10 |
comment |
When brute-forcing DES, does knowing something about the plaintext help? Are you talking about keys or plaintexts? The op is talking about plaintexts. |
|
Dec 10 |
answered | When brute-forcing DES, does knowing something about the plaintext help? |
