Reputation
405
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 11
Newest
 Yearling
Impact
~11k people reached

  • 0 posts edited
  • 1 helpful flag
  • 19 votes cast
Aug
15
comment Ransom attacks - can I protect myself by encrypting all my files?
@nocomprende The point of ransomware is that they spread easily and can stay hidden doing nothing until they've mapped the entire filesystem and are ready to start encrypting e.g. during the night. $200 dollars per victim multiplied by a hundred thousand paying victims (and yes, most will pay) = big bucks, that's why people bother doing it. It's obviously illegal, but do not be naively misled into thinking that the people who commit these crimes are insane; they have one and only one motive and it's making profit.
Aug
8
comment Ransom attacks - can I protect myself by encrypting all my files?
@nocomprende Quantum computers hardly affect symmetric cryptography, so "all forms of encryption" is a bit of a stretch. Asymmetric cryptography will require some reworking though, granted.
Aug
8
comment Ransom attacks - can I protect myself by encrypting all my files?
Just pointing out here that this is not the best analogy, because ransomware does not typically care what is in your safe (be it money or photo albums). All they want is that YOU care enough about it to give them money to unlock the safe they locked it into. Ransomware usually prioritize files that they know their owner attaches a great deal of importance to (because most people don't have backups), such as, say, jpg files in My Pictures, etc..
Mar
27
comment Can 'cracked' product keys harm the user in any way?
@StrongBad That's assuming you can reliably detect that a cracked key was used.. delete even a single legitimate user's hard drive by error and your product is finished. Seems like a pretty big risk for very little gain.
Mar
17
comment Is using the concatenation of multiple hash algorithms more secure?
@supercat H2(H1(x)) is called composition, not concatenation. I've never heard it referred to as concatenation either.
Mar
1
awarded  Yearling
Feb
12
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
@Xander Fair enough
Feb
12
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
@Xander My point was that the OP is only talking about the one-time-pad because that's what he knows, and isn't aware either that authentication is important or that unconditionally secure MAC's exist (or both). If he were, he would not have excluded it from his question, since encryption without authentication is useless as you have explained in your answer, therefore adding a note that the authentication problem is not a fundamental problem with unconditionally secure schemes seems in order, as opposed to simply dismissing the option (irrespective of how viable such schemes are in practice).
Feb
11
comment Can you say that since one time pad encryption is unbreakable, it is the best if used properly?
This answer fails to mention that there are information-theoretically secure integrity schemes, e.g. Wegman-Carter, and at least in principle you could bundle it with the OTP in a sort of information-theoretic cryptosystem - it's good to mention that integrity/authentication is essential, but then quickly taking a shortcut to "easy to use authenticated ciphers" sounds very much like avoiding the question in the context of "why isn't one-time-pad encryption [read: information-theoretic security] the best"; OP is really asking about unconditionally secure cryptosystems, not OTP specifically.
Oct
14
comment Are single case alphanumeric passwords the most user friendly?
Jesus christ, people. 20 hexadecimal characters. It's not that hard to remember a couple of them, seriously, especially with muscle memory. And you can use a password manager with a strong passphrase, there. In my experience, a long password made up from a reasonably small alphabet is INFINITELY easier to remember than a short one made up from a huge alphabet.
Oct
11
comment Do passphrases need to be run through PBKDF2? Almost impossible to brute force?
How would you enforce the usage of a strong passphrase in general? The whole raison d'etre of password-based KDF's is to compensate for poorly chosen passwords. If you take that out of the equation, by ensuring your passphrase has as much entropy as a typical key, then you vacuously don't need a PBKDF, only a plain KDF...
Sep
24
awarded  Autobiographer
Jul
14
suggested rejected edit on Is “the oft-cited XKCD scheme […] no longer good advice”?
Jun
30
comment How can a passphrase with 256 bits of entropy practically be constructed & memorized?
@NateKerkhofs You probably don't want to be typing that master passphrase (it is your master passphrase, right? if you're remembering one poem per website you frequent, well, hats off) into a website anyway. If you're looking for that level of security a password manager is almost certainly in order (but still, a pain to type in either way).
Jun
30
comment How can a passphrase with 256 bits of entropy practically be constructed & memorized?
Now for the next question: how to type in a 37-word poem into a prompt discreetly and in a timely manner without typos in a variety of environments :-)
May
14
comment Is saving a list of passwords in Acrobat XI with 256bit AES encryption as secure as something like KeePass?
"Is there any reason not to do this?" You mean apart from the fact that a PDF editor (and, more importantly, viewer) is not designed to be used as a password manager? Who's to say some viewers don't cache PDF files into a temporary folder for history/faster viewing/whatever? You wanted this to have access to your passwords on public/semipublic computers? Boom, there go all your passwords. If it's a private computer/phone, why not use a password manager (they can sync too, you know)? Basically, it's a bad idea, even if the crypto is sound (and the crypto itself is rarely the problem).
Feb
26
comment Why are salted hashes more secure?
@tylerl Thank you
Feb
24
comment Is using SHA-512 for storing passwords tolerable?
@SnakeDoc It is cryptographically secure, it's just not designed to be a password-based KDF.
Feb
22
comment Why are salted hashes more secure?
Could you please add a final paragraph about key stretching and using a proper KDF, otherwise this post is going to spawn yet more sha1(salt || pwd) schemes by users who only read this answer and went to do their thing. I know it's technically off-topic but we really need to fight this by trying not to suggest to use this directly.
Feb
8
comment Bad practice to have a “god” password?
This account has been terminated for the following reason: unauthorized access to donuts.