463 reputation
211
bio website
location
age
visits member for 3 years, 5 months
seen 14 hours ago

Jun
22
comment Trying to keep high school students out of the Wi-Fi network
Do note that preventing Wi-Fi access does not fundamentally solve the underlying problem of students having internet access: they can still use a mobile data plan. So on that front it's a lost battle, and should perhaps not even be a goal of this exercise.
Jun
20
comment Does verifying identity by positions in passwords mean passwords are stored unhashed?
@JeffMeden Yes but from the cryptographic perspective that's equivalent to "passwords are stored unhashed": the website operator has enough information to cheaply recover the original password, which means they are able to leak enough information for an attacker to do the same. So not much different to storing the password encrypted and hoping that only the database leaks and not the key(s).
Jun
16
revised Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
added 64 characters in body
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
OK I now understand that this scenario is implausible. LastPass would be silly to simply compare the hash they receive against the hash they store. I imagine what actually happens is: master password is hashed client-side. Hash is sent to LastPass. The hash is then hashed with those server-side 100k rounds. The result of that is compared to the database that leaked. Therefore to obtain encrypted passwords, the leaked hash is insufficient, and would be very difficult to crack within the window of opportunity that has now been closed.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
Surely it must hash the password client-side before performing authentication, because they cannot send the password itself (that's part of the promise: they don't know your master password). But I see a way out now: client sends a hash, server hashes it with 100,000 rounds and compares that against the stored hash. This makes my entire question redundant. I think I should close it.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
"Under those conditions, if an attacker was able to crack a user's master password" - but my question is whether with the leaked hashes they could retrieve the (encrypted) database without cracking anything, or perhaps by hacking only the client-side hashing rounds, of which there are significantly fewer.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
This relies on them being able to distinguish legitimate requests from attackers' requests. They may or may not be able to detect a well-planned attack where a large botnet is used to pull the ciphertexts slowly.
Jun
16
comment Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
@MikeOunsworth Unfortunately all the information I have comes from the LastPass blog post, and they don't specify how long it was between the leak and the time when they started requiring new IPs to verify by email.
Jun
16
asked Does a leaked LastPass hash enable the attacker to retrieve encrypted passwords (ciphertexts)?
Jun
14
comment NFC contactless payment security
I'd argue that it should be up to the user at which amount they are prompted to enter a pin. I'd set mine to zero to be prompted for every payment. NFC + pin would still be vastly faster than the current card payments in Europe. They are slow not because of the pin! They are slow because you wait and wait until you are even prompted for a pin, and then you wait some more afterwards.
Jun
10
accepted Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key?
Jun
10
comment Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key?
@SilverlightFox by "non-existent" I'm only pointing out that it's not available, otherwise it looked like it could raise people's hopes up. I've rephrased slightly.
Jun
10
revised Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key?
edited body
Jun
10
asked Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key?
May
21
comment HTTPS in captive portals and the Apple Captive Network Assistant
@Iszi over HTTPS after verifying the EV certificate to a company I also trust with my credit card at home - sure, why not? I'd love to authorize a one-off payment instead, but alas credit card systems aren't quite there yet.
May
21
asked HTTPS in captive portals and the Apple Captive Network Assistant
May
21
awarded  Citizen Patrol
Apr
29
accepted Are there any known breaches of the .NET AppDomain isolation?
Apr
27
awarded  Yearling
Apr
27
asked Are there any known breaches of the .NET AppDomain isolation?