395 reputation
211
bio website
location Wellington, New Zealand
age
visits member for 2 years, 8 months
seen 11 hours ago

I am an undergraduate computer science and mathematics student in New Zealand. My fields of interest are computer graphics, in particular the physics of light transport, and to some extent cryptography, as well as programming and software development in general.


Mar
4
asked Account lockout with human interaction required to unlock
Feb
28
comment What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?
Personally when looking for raw entropy, I find hexadecimal digits easiest to remember. Lower than that and the password gets too long, and beyond that there are too many symbols to remember. I use a 20-character hexadecimal passphrase as my master passphrase (80 bits of entropy). One can easily remember up to 128 bits, but not too many of them, which is why some form of password derivation is often desired.
Jan
12
comment Passing generated keys to another process
What is your threat model?
Jan
12
comment Passing generated keys to another process
Well, as far as absolute security goes, I'd say process communication would be safest, followed by the socket method (which is really a form of IPC). But for such considerations to be made, you'd have to assume the attacker has complete access to the system, and at that point he could just read your process's memory to get the key anyhow.
Dec
28
comment Why Do we Need CAPTCHA? In what case we should use it?
Or.. you know.. cheaply pay people in third world countries to solve captchas served by proxy.
Dec
28
comment Is possible to know if increased marketshare means more viruses?
In my humble opinion: 1, perpetuated by 2. But just my intuition.
Dec
22
comment Future proof encryption possible in theory?
Check out Tahoe-LAFS, they've apparently done some work on 100-year cryptography.
Dec
21
comment If someone asks to borrow your phone to make a call, what could they do?
Bullet point #1: I have found my true calling.
Dec
19
comment Gold Standard for password hashing
I should mention it here again, the 2^61 collision attack on SHA-1 (and even the 2^80 birthday attack) is irrelevant to password hashing..
Dec
18
comment Is my developer's home-brew password security right or wrong, and why?
@jmoreno In general, security by obscurity is perceived as a crutch for poor cryptography practices, and it often is. That doesn't mean it doesn't have value - it does have its uses, but in this situation it is not warranted.
Dec
18
comment Is my developer's home-brew password security right or wrong, and why?
@jmoreno Still doesn't justify his useless scheme.
Dec
16
comment How to authenticate a salted password?
Just thought I should mention the obvious, in case somebody gets the wrong idea: a 32-bit hash is not secure.
Dec
14
comment Is there value in storing passwords in their own table with encrypted or hashed keys?
And where do you propose the secret key be stored? If it's on the server, why should the hypothetical "hacker" not be able to get a hold of it if it can access the password and user tables?
Dec
14
comment Is it possible to decrypt symmetric key encryption without the key?
@NAlex No, I'm saying modern cryptography assumes plaintext is known and algorithms must ensure the key remains secret even under those circumstances. It would be a mistake to assume the attacker doesn't know the plaintext, because more often than not, he does.
Dec
13
comment Why don't people hash and salt usernames before storing them
Welcome, 21840c1a3e3db69e01445c8782a99f9b.
Dec
13
comment Is it possible to decrypt symmetric key encryption without the key?
The plaintext must not be assumed to be secret - at least parts of it are probably known to the attacker (common headers, etc...). There are also real life protocols which allow an attacker to obtain unlimited amounts of plaintext/ciphertext pairs, if your encryption scheme yields the key under those circumstances it has failed.
Dec
9
comment How difficult to crack keepass master password?
Moore's Law is starting to fail already - thermal limits have been reached for semiconductor transistors and the future is all about parallelization, which scales linearly, not exponentially.
Dec
1
comment How effectively can ISPs detect illegal file sharing?
@Rob Ignorance, mostly. Most people don't know about encryption, or think it doesn't help them, or mistakenly believe it slows down their downloads (it doesn't). There's been some progress in educating users but it hasn't reached out much so far, so I really do not believe most torrent clients are set to use encryption. I could, of course, be wrong.
Dec
1
awarded  Editor
Dec
1
revised How effectively can ISPs detect illegal file sharing?
added 328 characters in body