805 reputation
311
bio website coderinaworldofcode.blogspot.…
location
age
visits member for 2 years, 9 months
seen 2 hours ago

Research Assistant at the University of York. Nothing I do or say here represents my employer


1d
awarded  Nice Answer
2d
comment Can a lock picker slowly undermine the security of a deadbolt door?
That's not entirely true, as with certain mechanisms, knowledge about the construction of each particular lock lock is very useful (e.g. working out where security pins are). This would reduce the attackers time required to compromise the lock. Ergo, your response times may become inadequate at some point in the future -- unless you have entry alarms, and a good response time for an unauthorised entry.
2d
revised Can a lock picker slowly undermine the security of a deadbolt door?
Clarified about pin-tumbler locks when multi-session picking.
2d
answered Can a lock picker slowly undermine the security of a deadbolt door?
Nov
11
awarded  Custodian
Nov
11
reviewed Reviewed DiskCryptor error. Can it be fixed? or what equivalent disc encryption software should be installed? Thanks
Nov
3
comment Question about a simple strong password management system
Thanks @isarandi, I've fixed the error. Only a couple of orders of magnitude ;-)
Nov
3
revised Question about a simple strong password management system
Fixed an error by a couple of orders of magnitude
Nov
3
answered Question about a simple strong password management system
Oct
24
answered SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?
Oct
16
awarded  Excavator
Oct
16
revised Security of several files all using same password/key (7zip, AES256)
Edited for grammar & spelling mistakes (e.g. intent -> intend, s/he'll -> they'll)
Oct
16
suggested suggested edit on Security of several files all using same password/key (7zip, AES256)
Sep
24
awarded  Autobiographer
Aug
28
answered What's the difference between mitm attack and sniffing?
Aug
19
comment Using last characters of hash as salt
Although I broadly agree, the choice of using >256b of entropy is probably overkill. You only need enough bits to know that, with high probability, there will be no collisions in your database; taking into account the birthday paradox. For many small databases, this can actually be a surprisingly small number of bits. I often just leave it at 128b and call it a day, but resource constrained applications will want to consider this.
Feb
23
awarded  Yearling
Oct
4
comment Can a steel woven wallet prevent RFID scanning of credit card information?
Just as an interesting aside, this technology looks very similar to the OffPocket. If the construction is sufficiently similar, I would expect it to work in a similar fashion.
Aug
2
comment BREACH - a new attack against HTTP. What can be done?
This isn't actually that much of a mitigation; you can simply collect more packets and the variation(s) will become statistically significant. Obviously, this can be an impediment and slow down an attacker, but it doesn't stop the attack. The proper fix is to close the side-channel (stop compression).
Jul
16
comment Attack on the custom token-based sha256 security scheme
You may be able to perform a variation on a length extension attack (en.wikipedia.org/wiki/Length_extension_attack), but by pre-fixing the data rather than suffixing. Without thinking about this in depth, I couldn't say for certain, but it seems reasonable at first glance.