61,744 reputation
8118313
bio website
location
age
visits member for 4 years, 5 months
seen 4 hours ago

17h
awarded  Nice Answer
22h
comment Why no self-hosted email? (Snowden, Lavabit, Hushmail, NSA)
Where do your time estimates come from? Have you measured someone who is doing all of this for the first time, to see how long it actually takes? I suspect your time estimates are... a bit optimistic. (All of DKIM, SPF, DMARC, DNSSEC, DANE in 2 hours?) Sounds optimistic to me, for someone who has never done any of this before. Maybe for a professional administrator, but for an average person with some knowledge of Unix? In my experience, there are endless headaches: e.g., a prior user of your VPS used it to spam, so the IP addr is on a spam blacklist, stuff like that.
2d
comment How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like?
As the other comments are hinting... this answer is simply factually incorrect. Rejecting passwords you don't like does affect the entropy of the resulting password. Fortunately, the size of the effect is relatively small -- but the statements in this answer are not correct.
2d
comment How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like?
@Ajedi32, no, not a mis-click. Have you read the question and answers there carefully? Don't stop at just the title -- make sure to read the question and answers. Your "Huh?" comment arrived only 30 seconds after I provided the link; you'll probably need to spend more time absorbing the material there.
2d
comment How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like?
As is explained at security.stackexchange.com/q/6949/971, if you look at N candidate passphrases and keep the one you like best, the entropy has been diminished by at most lg N bits. Since in practice N will be small, this causes a very small harm to entropy -- so yes, if you don't like the result, you can instead generate a new password, and that will be safe, as long as you don't do that a crazy number of times.
2d
comment How secure is Snowden's MargaretThatcheris110%SEXY password?
I sense a lot of confusion about some basic points here. So, just to head some of it off, let me remind folks: it is meaningless to talk about the entropy of a (single) password; that's not well-defined. You can't talk about the entropy of a single value; instead, what is well-defined is the entropy of a distribution or a random process. So, if we hypothesize a particular random process for generating a password, then we can compute the entropy of that process. Those online "entropy calculators" don't actually calculate the entropy; they just compute some (possibly lousy) approximation.
2d
comment How secure is Snowden's MargaretThatcheris110%SEXY password?
"entropy isn't really a measure of password strength" - Not sure what your justification for that statement is. There's no source or citation or explanation. Sounds like a dubious conclusion to me. Why wouldn't it be a measure of password strength?
Jun
27
awarded  Nice Answer
Jun
26
awarded  Announcer
Jun
24
awarded  Nice Answer
Jun
24
awarded  Popular Question
Jun
20
awarded  Great Answer
Jun
19
asked Custom data in SSL certificate
Jun
15
awarded  Famous Question
Jun
11
awarded  Announcer
Jun
10
comment How do backdoors work?
2. We also want you to be specific, and to ask only about real problems you actually face. Your question is quite broad -- probably too broad to be suitable for this site. I count 5 questions in your post. We usually want you to ask 1 question per question. 3. Preferably, questions on this site should display a minimum level of understanding, appropriate for a professional-level site. See meta.security.stackexchange.com/q/16/971 and meta.security.stackexchange.com/q/1772/971.
Jun
10
comment How do backdoors work?
1. What research have you done? Where have you looked? We expect you to do a significant amount of research on your own before asking here, including searching here, via Google, on Wikipedia, and other standard sources. See security.stackexchange.com/help/how-to-ask. In this case there's lots of information on backdoors on Wikipedia: en.wikipedia.org/wiki/Backdoor_(computing). If your question is answered on Wikipedia, you probably haven't done enough research before asking.
Jun
10
awarded  Enlightened
Jun
10
awarded  Nice Answer
Jun
6
comment Can a wifi provider decrypt HTTPS usind MITM without users noticing?
Welcome to Security.SE! Your question is already covered by a bunch of other questions here: e.g., security.stackexchange.com/q/8145/971, security.stackexchange.com/q/48170/971, security.stackexchange.com/q/79550/971, security.stackexchange.com/q/55042/971, security.stackexchange.com/q/63304/971, security.stackexchange.com/q/20803/971, security.stackexchange.com/q/6290/971. In the future, please do more research on your own and make sure your question isn't already answered by existing resources here before asking a new question. Thank you!