Reputation
588
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 11
Newest
 Necromancer
Impact
~14k people reached

  • 0 posts edited
  • 0 helpful flags
  • 3 votes cast
Mar
2
awarded  Necromancer
Feb
22
comment Is using a public-key for logging in to SSH any better than saving a password?
@Gilles and I think you're missing my point, which is that nobody should be using memorable passwords for a production server. Passwords should be full random numbers, encoded using characters that can be typed on a keyboard.
Feb
21
comment Is using a public-key for logging in to SSH any better than saving a password?
To effectively brute force a 10 character password you need hundreds of trillions of guesses per second, and it'll still take weeks. No server is capable of receiving anything remotely close to that many SSH login attempts. A few hundred attempts per second is more realistic, which is too slow to be effective unless the password is terrible. Anybody reading this website is smart enough to choose a good password.
Feb
21
comment Is using a public-key for logging in to SSH any better than saving a password?
@Gilles asymmetric keys like those used in SSH all have at least 1024 bits of entropy, not 128. However asymmetric encryption also requires more entropy. 1024 bit asymmetric is weaker than 128 bit symmetric encryption. When somebody tries to brute force an SSH server, they have to do it "slowly" to avoid creating a denial of service attack. This means a password with ~50 bits of entropy will take hundreds of millions of years to guess. Go any faster and the server will be blown off the internet for the duration of the attack, and the sysadmin is going to notice/investigate.
Jan
21
comment How safe is the new iOS Keychain that stores credit card numbers?
@pnizzle then it generates a random key and stores it in plaintext/unencrypted on the disk... using that random key to encrypt everything (so you can securely "erase" data by destroying the key). From memory, iCloud Keychain cannot be enabled without also creating a device passcode.
Sep
10
awarded  Notable Question
Jul
28
awarded  Popular Question
Dec
8
comment How safe is the new iOS Keychain that stores credit card numbers?
LastPass and 1Password both also store your credit card in the cloud and allow you to retrieve it. They also have weaker security than Apple.
Dec
5
awarded  Revival
Nov
29
revised How safe is the new iOS Keychain that stores credit card numbers?
added 360 characters in body; added 127 characters in body
Nov
29
answered How safe is the new iOS Keychain that stores credit card numbers?
Oct
16
comment Could SQRL really be as secure as they say?
@LateralFractal who cares if it's new or not? SQRL allows user friendly authentication where the 1st party does not expose their secret with the 2nd party or any 3rd party who might have compromised the 2nd party's security. It's an attempt to solve a real world problem that, so far, nobody else has been able to solve.
Oct
14
awarded  Commentator
Oct
14
comment Could SQRL really be as secure as they say?
"To enable SQRL for you, you have to create your master key and store it on your phone." Actually, you don't need to do that, you just need some software on your PC that can open sqrl:// URLs.
Oct
14
comment Could SQRL really be as secure as they say?
"I know that only I and one website share each one-shot password in my encrypted key-store." Right, but the advantage of SQRL is that only you are storing the password. The server on the other end also has your password and they might be compromised by a rouge employee, by the NSA, or by a hacker. With SQRL you are the only person with the private key and it's up to you to decide how secure you want it to be. You don't have to ever store it on a mobile device, the QR code is just a URL and presumably would be wrapped in an <a> tag. Just have software on your PC to handle the sqrl:// protocol
Sep
30
comment Do any security experts recommend bcrypt for password storage?
@TerisRiel I don't mind if a user's account goes offline due to a DOS attack. In the real world it doesn't actually happen, and if it does... well that's better than the account being hacked.
Sep
2
awarded  Yearling
Sep
1
comment Is the Web browser status bar always trustable?
You can't trust them. There have been a million different cases over the years where browsers have been tricked into doing something other than what the user expected. If you can't absolutely trust the page you have visited, just close the browser window. Don't touch anything. Providing links to past situations isn't very useful, because new techniques are invented regularly. Seriously, just don't trust it.
Sep
1
comment Why is password hashing considered so important?
It is incorrect to state that "old" hashing algorithms are fast and "new" ones are slow. Most hashing algorithms were never designed to be used for passwords and there are plenty of new ones that are completely unsuitable. It's off topic for this question, but basically make sure you do your homework and choose a hashing algorithm that is strong and trustworthy, or else your users will be at risk.
Aug
31
awarded  Good Answer