395 reputation
211
bio website
location Wellington, New Zealand
age
visits member for 2 years, 7 months
seen yesterday

I am an undergraduate computer science and mathematics student in New Zealand. My fields of interest are computer graphics, in particular the physics of light transport, and to some extent cryptography, as well as programming and software development in general.


Oct
14
comment Are single case alphanumeric passwords the most user friendly?
Jesus christ, people. 20 hexadecimal characters. It's not that hard to remember a couple of them, seriously, especially with muscle memory. And you can use a password manager with a strong passphrase, there. In my experience, a long password made up from a reasonably small alphabet is INFINITELY easier to remember than a short one made up from a huge alphabet.
Oct
11
comment Do passphrases need to be run through PBKDF2? Almost impossible to brute force?
How would you enforce the usage of a strong passphrase in general? The whole raison d'etre of password-based KDF's is to compensate for poorly chosen passwords. If you take that out of the equation, by ensuring your passphrase has as much entropy as a typical key, then you vacuously don't need a PBKDF, only a plain KDF...
Jun
30
comment How can a passphrase with 256 bits of entropy practically be constructed & memorized?
@NateKerkhofs You probably don't want to be typing that master passphrase (it is your master passphrase, right? if you're remembering one poem per website you frequent, well, hats off) into a website anyway. If you're looking for that level of security a password manager is almost certainly in order (but still, a pain to type in either way).
Jun
30
comment How can a passphrase with 256 bits of entropy practically be constructed & memorized?
Now for the next question: how to type in a 37-word poem into a prompt discreetly and in a timely manner without typos in a variety of environments :-)
May
14
comment Is saving a list of passwords in Acrobat XI with 256bit AES encryption as secure as something like KeePass?
"Is there any reason not to do this?" You mean apart from the fact that a PDF editor (and, more importantly, viewer) is not designed to be used as a password manager? Who's to say some viewers don't cache PDF files into a temporary folder for history/faster viewing/whatever? You wanted this to have access to your passwords on public/semipublic computers? Boom, there go all your passwords. If it's a private computer/phone, why not use a password manager (they can sync too, you know)? Basically, it's a bad idea, even if the crypto is sound (and the crypto itself is rarely the problem).
Apr
12
comment How difficult to crack keepass master password?
@Pacerier Except most of these are not practical yet. If you are able to predict the future evolution of computing power with exotic hardware, then you can certainly make a good estimate of what constitutes a "hard problem". Most of us can't.
Feb
26
comment Why are salted hashes more secure?
@tylerl Thank you
Feb
24
comment Is using SHA-512 for storing passwords tolerable?
@SnakeDoc It is cryptographically secure, it's just not designed to be a password-based KDF.
Feb
22
comment Why are salted hashes more secure?
Could you please add a final paragraph about key stretching and using a proper KDF, otherwise this post is going to spawn yet more sha1(salt || pwd) schemes by users who only read this answer and went to do their thing. I know it's technically off-topic but we really need to fight this by trying not to suggest to use this directly.
Feb
8
comment Bad practice to have a “god” password?
This account has been terminated for the following reason: unauthorized access to donuts.
Jan
29
comment My home PC was hacked and accessed my bank! Advice on next steps?
s/not find/find
Jan
18
comment What is the excellence of RSA vs my algorithm
It's quite easy to obtain d from e. Just run the "test" function on it and get a (somehow) valid "d" for it. Oops? What does your algorithm do? It's nonsense as it is now.
Jan
14
comment Forward secrecy for kids
@ewanm89 It gets rather tedious doing it by hand for 1024+ bit parameters.
Dec
27
comment How to change TEA round count?
Well, in all fairness, now that I read it again, my comment was somewhat tautological. Glad you found the problem though!
Dec
27
comment How to change TEA round count?
There's probably something else you didn't change that's still assuming 32 rounds are used and that's throwing decryption off.
Dec
21
comment Can the xor of two RNG outputs ever be less secure than one of them?
If they are the same, there may be a slight bias in the output...
Dec
18
comment One time pad encryption
If the key is shorter than the plaintext, it's not an OTP. How that cipher handles wrap-around is up to how it is defined, but usually the key is repeated from the start (and you get a Vigenere cipher).
Nov
28
comment What to do when I found a spyware that my spouse has installed?
@Adnan Good to know, thanks. I would still recommend a reinstall just for peace of mind, though.
Nov
28
comment What to do when I found a spyware that my spouse has installed?
But what if she knows that he knows that she doesn't know that he knows?
Nov
28
comment What to do when I found a spyware that my spouse has installed?
Why would you trust a keylogger to only send its stuff to the given email address and happily uninstall itself without leaving behind something even worse? The argument would have been valid if she had written the keylogger from scratch (sort of) and she obviously didn't. Nuke from orbit then have a talk.