146 reputation
7
bio website nuovolabs.com
location Jupiter, FL
age
visits member for 3 years, 8 months
seen Jun 28 at 20:44

I am a Python / Django developer. I specialize in developing SAAS applications using Django. My language of choice is Python, but I am sometimes forced to use English. Django rules.


Jun
28
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
What a very frustrating set of answers to come across. The answer is simple: each hash can be the result of an infinite number of strings being hashed, so there is no way of knowing which one a hash was meant to represent - even more simply put, a hash doesn't represent any one value.
Jun
28
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
This isn't "one aspect of the problem". It's the entire answer. This is the most frustrating question I've ever come across, because every one of the answers are wrong, except for yours. I didn't read your entire answer only the first paragraph, which answers everything.
Oct
20
answered Isn't all security “through obscurity”?
Oct
20
comment Isn't all security “through obscurity”?
How can you "measure" the mathematical probability of a "secret" becoming an "obscurity", especially in the age of highly experimental (e.g. quantum) computers. At some point, your 128bit key might be quicker cracked than the port on which your "here's my password" service runs can be guessed (since each network connection might take longer to make than the processing time required to break your key). Just because that's probably not true today does not place your idea of a "secret" squarely into a different class than what you call "obscurity". They are both exactly in the same continuum.
Jul
26
awarded  Critic
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Could you look at my last comment to @apsillers on the original question. I don't think this answers my question or resolves the concern, still.
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
@apsillers - ugh... I just realized, I wasn't thinking backwards. I keep my private key on my notebook and put my public key on my server (in ~/.ssh/authorized_keys to allow me to SSH from my notebook to my server. This is precisely the scenario I was concerned with, connecting to a server out there that is actually a MITM pretending to be my server (also having the public key of course).
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Ah, thanks man. This is the light bulb moment I was looking for. Despite my having originally flip-flopped the public/private situation in my head, I was still left with some confusion, especially after having conflated the issue of CAs and then plain ol' PKI via something like SSH.
Jul
26
accepted If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
@apsillers - ah, so I just had it completely backwards in my head when I started writing this question. Does this mean that, without distributing my private key, there is no possible way that any value whatsoever can be gleaned from having my public key and being a MITM, which can't already be gleaned by simply being a MITM? If so, could you please word this out into an answer so that I can accept it. Also, if so, I now feel a lot more comfortable about all the recent scares pertaining to PKI being rendered obsolete by the NSA, etc. (except that they're asking for the actual private keys).
Jul
26
revised If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
edited title
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
@BrendanLong - I have a private key, whose public counterpart is on a server that I intend to SSH to.
Jul
26
revised If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
Removed the second question to avoid confusion about the first question.
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
@BrendanLong - I'm not sure I follow. I (A) am the owner of the public/private pair, and have distributed my public key so that anyone can have it. There is a MITM (BAD) who controls my WAN access (including DNS lookups, naturally), who also has my public key (since it's distributed). I am trying to connect to GOOD (which also has my public key).
Jul
26
comment If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
What I mean isn't to suggest they can pretend they're me because they have my public key, but rather that they can pretend they're the server I'm trying to connect to, if they're between me and that server, and they have my public key.
Jul
26
revised If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
added 161 characters in body
Jul
26
asked If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate?
May
15
awarded  Commentator
May
15
comment Securing my firewall (both dedicated and iptables-based)
Aha, excellent. Thanks for the extra info!
May
14
comment Securing my firewall (both dedicated and iptables-based)
Thanks so much! Btw, 1) do you mean that "POLICY (-P)" at the bottom of my rules has the exact same effect? And, 2) (regarding VPN port 22). My understanding was that if I VPN into a private network, and SSH into my server, I'll be gaining access due to the fact that my firewall allows VPN traffic on port 22. My server is set up to not care either way (I have SSH "hardened"), but for added safety, port 22 traffic is not allowed on the public network. Did I state that all correctly, or is there a bigger picture I'm missing? Also, if iptables blocks a lot of requests, will my logs grow huge?