meta user
network profile
| bio | website | bradconte.com |
|---|---|---|
| location | Texas, USA | |
| age | 25 | |
| visits | member for | 1 year, 1 month |
| seen | 7 mins ago | |
| stats | profile views | 21 |
I'm a software engineer. My specific interests are Cryptography and computer security. I graduated from UC Davis with B.S.s in C.S. and pure math.
|
Apr 2 |
awarded | Yearling |
|
Feb 26 |
comment |
Key length and hash function in PBKDF2 Worth noting for clarity on the quoted paragraph: The first part refers to output length of output used as an encryption key. But the latter part of the paragraph refers to output lengths of output used as a hash of the original password. |
|
Feb 26 |
revised |
Key length and hash function in PBKDF2 edited tags |
|
Feb 20 |
revised |
Ethernet security Proper list style. |
|
Feb 20 |
revised |
Ethernet security Rewording. |
|
Feb 20 |
answered | Ethernet security |
|
Feb 15 |
revised |
Can URLs be sniffed when using SSL? edited tags |
|
Feb 15 |
reviewed | No Action Needed Create a unterminable process in Windows |
|
Feb 15 |
reviewed | Reviewed An attack from my Employer |
|
Feb 12 |
revised |
Is it reasonable to prevent timing attacks by using fixed processing time edited tags |
|
Feb 12 |
answered | How isolated are 2 operating systems on 1 harddisk? |
|
Feb 12 |
answered | Is it reasonable to prevent timing attacks by using fixed processing time |
|
Feb 11 |
revised |
Why is it even possible to forge sender header in e-mail? Typos in the main question made it difficult to parse. |
|
Feb 11 |
answered | Why is it even possible to forge sender header in e-mail? |
|
Feb 11 |
suggested | suggested edit on Why is it even possible to forge sender header in e-mail? |
|
Feb 10 |
answered | Good Practice: Storing Passwords in general |
|
Feb 8 |
revised |
Insecure to require numbers in passwords? Clarified the 90% estimate. |
|
Feb 8 |
comment |
Insecure to require numbers in passwords? 1) You're right, I hit the wrong log. 2) Probably not what was meant, since it was the numbers and special character restriction they actually encountered, so I'd think that's what they're interested in. 10 is because many password requirements restrict the special characters allowed in passwords, with verbage similar to "only numbers, letters, and - , _ . + are allowed". I've seen even fewer than 10 special characters permitted. 3) Very true, it is indeed a simple calculation. Remember inclusion/exclusion, though, the (-62^10-62^10-52^10) is double-counting. (Doesn't effect much, though.) |
|
Feb 8 |
comment |
Insecure to require numbers in passwords? You forgot to account for the special character, (52/72)^10 = 3%. But 3% tells us little about passwords containing both. Instead, I was interested to note that giving the mandatory characters fixed positions gave a trivial lower bound of (10/72)^2 = 0.02 = 2% (since they are not actually fixed it will obviously be much greater) and ln(.02) is -3.9, so we can't lose more than about 4 bits. Since that is probably negligible, almost any estimate is in the right ballpark. The takeaway was that it doesn't matter what the exact restrictions are in this type of case, the impact is negligible. |
|
Feb 8 |
revised |
Does not having https moot this entire site? typos |
