395 reputation
211
bio website
location Wellington, New Zealand
age
visits member for 2 years, 8 months
seen 14 hours ago

I am an undergraduate computer science and mathematics student in New Zealand. My fields of interest are computer graphics, in particular the physics of light transport, and to some extent cryptography, as well as programming and software development in general.


Nov
28
comment What to do when I found a spyware that my spouse has installed?
But what if she knows that he knows that she doesn't know that he knows?
Nov
28
comment What to do when I found a spyware that my spouse has installed?
Why would you trust a keylogger to only send its stuff to the given email address and happily uninstall itself without leaving behind something even worse? The argument would have been valid if she had written the keylogger from scratch (sort of) and she obviously didn't. Nuke from orbit then have a talk.
Nov
8
comment Cryptography that looks like ordinary email
@Dakeyras Have you tried it? Encoding data to approximate the statistical properties of a legitimate carrier is ultimately what steganography is all about, you make it sound like a solved problem, but in reality this is hard to achieve and you have to work hard to reach a point where only a determined analyst would not be fooled.
Nov
8
comment Cryptography that looks like ordinary email
@Dakeyras Except it doesn't. The least significant bit of most images doesn't follow a uniform distribution. It might be imperceptible to the human eye, but an algorithm checking the statistical properties of the LSB of each pixel will detect that bias instantly. This method is popular, and there will be such an algorithm somewhere along the way.
Nov
3
comment What does the email header-line “message opened by mailclient” mean?
I initially read the title as "opened by malicient", as in "malicious client". Interesting..
Oct
14
awarded  Citizen Patrol
Sep
20
comment How can I measure (and increase) entropy on Mac OS X?
This question appears to be off-topic because it is about software use of cryptography.
Sep
20
comment How can I measure (and increase) entropy on Mac OS X?
This is off-topic, and needs to be migrated to Security SE, but I'll answer quickly the first question: /dev/random will block until the system estimates it has the entropy you asked for, so all you have to do is read and wait (if you don't want to block, there are system calls to get the current estimated entropy).
Sep
11
comment Is there any point in using 'strong' passwords?
@Bakuriu Except that "possibility" is what you actually care about here. You are using probability outside its range of applicability to the problem at hand, and engaging in theoretical trivia which is meaningless in practice. Sorry but I have to disagree.
Sep
11
comment Is there any point in using 'strong' passwords?
@Bakuriu No, it's not a possibility. The probability is so low that the chance of you "getting lucky" and brute-forcing that 100+ bits of entropy password is zero. Period. At such small scales, probability ceases to be meaningful, and using the "mathematically the probability is not zero" argument is simply not reasonable (and that is without even considering that the "probability" of your brute forcing program failing due to a hardware error and reporting a false positive is unimaginably larger than the probability of it succeeding in a "feasible time").
Aug
23
comment 419 Nigerian scam problem
@OlivierDulac Let us hope no-one takes it too literally.
Aug
18
comment What are the security implications of storing password blacklist?
Removing 1000 passwords from the potential passwords to try will have a negligible impact on the attacker's workload. The point here is to prevent people picking 123456, password, guest, etc.. think of it as those pesky password rules, but more controlled and sane.
Jun
14
comment Is it legal to find bugs on a website and report them to the website's owner?
@StasM You should probably report it anonymously either way so you wouldn't get credit anyway (well, maybe they will add a "fixed by anon" somewhere in their changelog, but hey) :p
May
9
comment Is salting a hash really as secure as common knowledge implies?
@ThomasAndreèLian Not for some randomly generated salt, no.
Mar
12
awarded  Yearling
Mar
5
comment Account lockout with human interaction required to unlock
The help desk is not 24/7. If this happens at night, you are screwed.
Mar
5
accepted Account lockout with human interaction required to unlock
Mar
4
comment Account lockout with human interaction required to unlock
As for the accounts themselves, they are not particularly valuable in and of themselves, but since you need an account to access many of the online services, a compromise could cause major disruption.
Mar
4
comment Account lockout with human interaction required to unlock
No, it simply says "ERROR: The username and/or password you entered is not correct." in either case.
Mar
4
comment Account lockout with human interaction required to unlock
The username is a simple first name/surname mashup, and I believe I have access to enrolment lists for the courses I'm attending, so I think I could derive at least two hundred usernames without too much difficulty. And even then it would not be infeasible to hang around the library and snoop on people's username as they log on. Not sure about an external attacker, but if the system is as fragile as I fear it is, an attacker with inside information could certainly do a lot of damage.