Reputation
4,750
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 7 27
Newest
 Nice Answer
Impact
~287k people reached

Jan
4
comment What's the point of using multiple checksum algorithm with “aide”?
"Note that hashing tends to be fast anyway; when hashing files from disk, or data from the network, the hash function is rarely the bottleneck." ... well, kind of. It's all relative; there are hashes designed for pure speed in checksum applications, such as Murmur and FNV. These are by no means cryptographically strong, of course, but they leave SHA2 in the dust. SHA2 is in turn light-years faster than implementations designed specifically to be slow as a counter to low input entropy, such as bcrypt/scrypt/PBKDF2.
Jan
4
answered How is Chase Mobile Deposit Secure?
Jan
2
comment Is it possible to change the wifi password with a script?
If it is, it's a serious vulnerability. You could use a Windows Shell or Bash script (or even an iMacro) to automate the login and navigation (assuming you know the login i the first place), but I seriously doubt any router manufacturer would ever be stupid enough to specifically allow scripted, unauthenticated password resets.
Jan
2
comment Is SiteKey a valid defense against Phishing?
To which the answer is, IMO, "no effect", because any additional bar-raising in forcing a MITM to impersonate the user against the real site is wiped out by the inherent added trust in the faulty system, leading them to disregard more technically-secure methods of server authentication. You (or your attacker) can tell a user that entering their password by submitting it in an e-mail is required in order to be "more secure", and someone will believe it. In this case, the inherent weakness is even harder to spot.
Jan
2
comment Are older viruses removed from virus definition files?
+1. To say it the way I was going to say it, AV definitions files never lose the ability to detect any known virus, but as derivative implementations and a general pattern or "signature" to the virus becomes evident, specific definitions may be "merged" into a more general heuristic signature.
Jan
2
answered Is SiteKey a valid defense against Phishing?
Jan
2
comment What is this authentication method/approach called?
+1 now that the answer has been edited to give a Googleable term.
Jan
2
revised VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
added 16 characters in body
Dec
31
revised Is bcrypt better than scrypt
added 56 characters in body
Dec
31
comment Future proof encryption possible in theory?
However, for one message, encrypted one time, which must not only withstand 100 years of brute force but must also be decryptable in 100 years, the OTP is perfect. You keep saying you could thoroughly document; how much data in the form of documentation would you have to make readily available, in order to describe the decryption process accurately enough that someone could re-implement the algorithm on whatever hardware we're using in 100 years (whether that's optronics, qubits, or - if we bombed ourselves back to the stone age, paper and pencil)? All for one message?
Dec
31
comment Future proof encryption possible in theory?
The OTP has one critical requirement that shakes out from the three critical pieces that define the scheme (key length = message length, truly random, used once); the two parties to the conversation must be able to physically exchange OTPs. That makes it infeasible for most of what we use cryptography for today; we transmit untold gigabytes of data securely every second over the Internet, and would need an unworkable amount of pre-exchanged random data to make a OTP work.
Dec
31
comment Future proof encryption possible in theory?
From a whitepaper on the subject: "Modern crypto algorithms provide practical reasonable security and privacy, essential to our economy and everyday life. However, sometimes you need ever lasting absolute security and privacy, and that's only possible with one-time encryption. Some experts argue that the distribution of large quantities of one-time pads or keys is impractical. However, ... Current data storage technology such as USB sticks, DVD’s, external hard disks or solid-state drives enable the physical transport of enormous quantities of truly random keys."
Dec
31
comment Future proof encryption possible in theory?
That statement is talking about using a OTP for modern cryptographic needs over an untrusted wide-area network, where there is no such thing as "offline data transfer". The key simply must be exchanged securely, and since "securely" translates to "by public key algorithm" over a network, you're right. However, I could meet you in person, give you a OTP, then send you out into the African bush with a simple wireless ham radio, and you could tell me something securely that neither of us knew when we exchanged the OTP.
Dec
31
revised Is bcrypt better than scrypt
added 418 characters in body
Dec
31
revised Is bcrypt better than scrypt
added 418 characters in body
Dec
31
revised Is bcrypt better than scrypt
added 365 characters in body
Dec
31
answered Is bcrypt better than scrypt
Dec
31
revised Future proof encryption possible in theory?
added 30 characters in body
Dec
31
comment Future proof encryption possible in theory?
@drjimbob - I would tend to agree with Graham Hill here; you must always keep the key secret, whether it's a OTP or AES, and so all the "non-computational cryptanalysis" methods you mention will get you an AES key just as easily as a OTP. Therefore the crux of your argument is that for sufficiently long message sizes, OTP storage becomes difficult compared to just 256 bits of an AES key. While I see that point, I think the bigger concern is storing the key and the ciphertext in a manner that will still be accessible in 100 years, after USB, Firewire and SATA have all become extinct.
Dec
30
revised How can I explain the concept of public and private keys without technical jargon?
deleted 2277 characters in body