168 reputation
9
bio website
location United States
age
visits member for 2 years, 1 month
seen Jul 4 '13 at 16:31

Jul
4
awarded  Commentator
Jul
4
comment Does hashing a file from an unsigned website give a false sense of security?
I'd wager that the false sense of security is a strong argument for not providing hashes...ever. I don't know the last time TCP/IP failed and I got a corrupt download. That's happened...never.
Feb
8
comment Does not having https moot this entire site?
Yeah, forgot about meta.so. Just read up on those. Still think it's probably worth it, but good to see the argument in the open.
Feb
8
accepted Does not having https moot this entire site?
Feb
8
comment Does not having https moot this entire site?
Fair enough. I guess I am uncomfortable not knowing the info I'm receiving hasn't been tampered with, especially in niche security questions. I'm not in a oppressive location right now, but it's quite terrifying when you are.
Feb
8
comment Does not having https moot this entire site?
And, I suppose, no way for us to prove your information is correct. Seems we should be rallying for this on SO.
Feb
8
asked Does not having https moot this entire site?
Nov
29
awarded  Popular Question
Apr
4
comment Best practice for password distribution
I mean keys in the general sense, and include passwords as a variety of key. Sorry to be unclear. My question really is: "What is the best practice for getting a new user into a system," which I hope I've asked above. If you look at @legolas's answer, you can see it's basically about key distribution.
Apr
3
comment Best practice for password distribution
Agree that SSH is better. @chrisallenlane also suggested this, and my response was that I'm more interested in the authentication issues of key distribution.
Apr
2
awarded  Supporter
Apr
2
awarded  Scholar
Apr
2
awarded  Benefactor
Apr
2
comment Best practice for password distribution
Thanks for the added details and the direct explanation. I think you and @legolas basically had the same answer, but I'm a person that likes lots of details, so I gave him the bounty and you the upvote. Good stuff though.
Apr
2
accepted Best practice for password distribution
Mar
30
awarded  Nice Question
Mar
27
awarded  Promoter
Mar
27
comment Best practice for password distribution
Regular mail seems slow and unnecessary. Surely we can do better, right?
Mar
27
comment Best practice for password distribution
SSH keys are useful, but I think the real question I'm getting at is the bootstrapping one.
Mar
27
comment Best practice for password distribution
Seems like if the verification step is necessary, it has to happen before you've let them in. Otherwise, it's already too late. Real-time does sound like part of the solution though.