1,070 reputation
821
bio website
location
age
visits member for 2 years, 3 months
seen 18 hours ago

Jan
7
awarded  Yearling
Nov
8
awarded  Good Question
Oct
8
accepted Is it safe for GPG to compress all messages prior to encryption by default?
Oct
6
comment Is it safe for GPG to compress all messages prior to encryption by default?
Sorry, meant BREACH not BEAST. These acronyms are getting ridiculous.
Oct
6
revised Is it safe for GPG to compress all messages prior to encryption by default?
added 1 characters in body
Oct
6
revised Is it safe for GPG to compress all messages prior to encryption by default?
edited title
Oct
6
asked Is it safe for GPG to compress all messages prior to encryption by default?
Sep
30
awarded  Nice Question
Sep
27
accepted How can a network observer identify computers running old versions of Java?
Sep
27
comment How can a network observer identify computers running old versions of Java?
It was legitimate, and they did indeed send it in an email. I hear where you're coming from, but in this instance that's not what happened.
Sep
23
asked How can a network observer identify computers running old versions of Java?
Sep
1
awarded  Notable Question
Aug
6
awarded  Announcer
Jul
25
awarded  Notable Question
May
18
awarded  Announcer
Apr
8
comment Is leaking the hash of your encryption key a security risk?
@JohnLeidegren is it possible to have the sender know the recipients public key ahead of time? Then the sender can simply make up a key and encrypt it using the receiver's public key. This would allow you to use RSA or another established asymmetric encryption scheme rather than reinventing one.
Mar
23
comment Why are GPUs so good at cracking passwords?
Some context on the numbers: assuming a set of about 100 possible characters, there are 1 trillion possible 6-digit passwords. At a billion passwords per second, this is a bit under 17 minutes to try every possible 6-digit password. Less if we assume the character set is smaller (most people will never use a good chunk of the printable ASCII character set in passwords). Another reminder to salt your hashes.
Mar
22
awarded  Popular Question
Mar
10
comment Should I change the default SSH port on linux servers?
Note that running SSH on a port over 1024 (i.e. a non-priveleged port) is actually potentially a security vulnerability. Only root can bind to privileged ports (<1024), so you can know that services running here are at least started by root. Let's say you run SSH on port 2222 and your sshd crashes for some reason. Now any local user can start their own (fake) sshd on port 2222 which might do bad things like stealing your password!
Feb
18
comment Hiding JavaScript source code
@Celeritas if your company makes a cool web app with lots of clientside JavaScript, they probably want to prevent other companies from making a clone of their web app and stealing their customers. By obfuscating the code, which anybody can see, you make it harder to make a copy of the code, since it's purposefully made difficult to understand by a human. You can still make a copy of the obfuscated code, but normally you will want to modify it (e.g. to work with your server), and that's harder. Obfuscating code has little to do with security and lots to do with protecting property.