My favorite part is when the project manager starts whining about how, "I don't care if the work doesn't meet regulatory compliance. You need to just approve it because otherwise my estimates aren't going to work out."
I feel like we got off on the wrong foot. Due to me being an idiot miscommunication, a partial change snuck out early, and even though we announced it we didn't really explain why we made the change. So let me just start over...
We've made some changes to Close as Duplicate.
First, some back...
If Red Hat wants to deep-throat Microsoft, that's *your* issue. That has nothing what-so-ever to do with the kernel I maintain. It's trivial for you guys to have a signing machine that parses the PE binary, verifies the signatures, and signs the resulting keys with your own key. You already wrote the code, for chissake, it's in that f*cking pull request.
@TerryChia when I polled everyone here not too long ago, the consensus was Linksys E2500.
so far I only loaded up dd-wrt - went very smoothly - but havent really given it a real testing yet.
on the other hand, after I'd ordered it, I found a review that claims its range is a bit on the short side, but as I said I havent really tested that yet.
You know it's not a password someone at your organisation set several years ago when you can't crack it with hashcat bruteforcing every passphrase upto 6 chars :-p
@Tinned_Tuna I think it's because we forwarded a socket from the server onto his laptop so that he could do some 'local' testing. i seem to remember creating an account just for that. so he probably had a normal dev key plus that one.
@TerryChia Have added a couple of links, some minor formatting, added a link to your blog and added the standard QoTW footer. I like it. Currently scheduled for Friday midday (GMT)
Nope, the exit node can only decrypt the message and make the request, but he is not aware of where the original host is located, the only node that knows where the person is located is the second node. This is due to the layered encryption Tor uses. Every node only knows the next and previous h...
Nothing wrong with either answer, but I'm still left wondering.
@ScottPack The Power of Five series by Anthony Horowitz. Not really great, but I figured since I got through the first book I might as well read the other four.
The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:
http://helpdesk.lastpass.com/account-recovery/
My question is, how can you have more than one password?
I thought LastPass derived the encryption key from your master password usin...
@Tinned_Tuna standby ill try to find what i was reading
@Tinned_Tuna ahh you're right. I was reading people's estimations of how well it could be used for cracking. Part of the conversation was how opaque the GPU API is.
I wonder if I should spring for a dual band router considering my house only has 1 device (my usb wireless adapter meant for pen testing use) supports the 5GHz band...
This is explicit in the article. They chose Blowfish as base because Blowfish key schedule intrinsically requires a 4 kB RAM block (which is altered a lot in the process).
Oh, @ThomasPornin. Do you consider scrypt mature enough to use in serious applications now? I remember one of your answers recommending to wait and see.
@TerryChia well... scrypt uses Salsa20, and Salsa20 was one of the eStream winners...
@ThomasPornin I thought in the scrypt paper it defined memory-hardness as being able to use a configurable amount of memory, not just a fixed "It's big at the moment!" amount?
@ThomasPornin not entirely... If the passwords are leaked to the public, the attacker has a very long time to work on them, and if the breach isn't made public (i.e. the attackers try to crack it in secret, and the breach is undiscovered), then they have basically limitless time to attack the password
@TerryChia no, they didn't have that exact definition, but what I'm getting at is that if you configure bcrypt correctly, can you scale the amount of memory needed by using configuration?
@ThomasPornin I know that :-p, it's more that, if it's been used in the correct way, and you're confident about the properties of Salsa20, then you can gain some confidence in the design of scrypt
scrypt offers an extra tunable parameter, which is good (yeah ! an extra parameter to finely tune the algorithm !) and bad (dammit, the complexity of configuration has just been squared !)
The authentication was only necessary to know that the encryption was right, your idea is good. But I think that way if password change would have to re-encrypt the data. That would not be a way.
The link seems very interesting. Excuse me for my stupidity, but I do not understand from step 3. And the concept of "blocking" not clear to me.
Thank you very much. — user601081 min ago
Hmm, what would be the most polite way of saying Don't fucking design an encryption program if you don't understand it?
@TerryChia If you want to be diplomatic, say: "Trained cryptographers would not dare design their own encryption algorithm; when they must do it, they wait for dozens of their colleagues to give their opinion."
But you also have the option of not responding. Works well, too.
Yea, most abstract analyses of crypto algorithms (authenticated ones, at least) return either the decryption, or "bottom" if there was some form of error, be it a MAC error, or some other error (e.g. padding error)
well, they deal in those terms.
unfortunately, this doesn't model the real world fantastically well, as people love returning detailed error messages.
@Tinned_Tuna Detailed error messages are, usually, a good idea. I daily battle against a system for which every single failure is "error 50000", and that's not fun.
@ThomasPornin At uni I was often told that Serpent should have become AES. That it was stronger in many ways than Rijndael (which became AES). I can't remember what precise reasons were given. Of course now there's so much water under the AES bridge that Rijndael can probably be said to be a safer choice. Any thoughts?
@TerryChia ah yes, to a private log file, you can say that the padding was wrong or what ever, but it depends on your threat model.
what if you've designed a system which for some bizarre reason an adversary can read the log file(s)
you've likely already lost at that point, but you know what I mean
@TerryChia basically, your adversary should only ever get one type of error back. Place your adversary where you like, depending on your paranoia level.
@Tinned_Tuna an old favourite from way back was an apache server that was able to read it's own access logs, which contained a page vulnerable to local file inclusion. So you send a GET request with some embedded php, which gets written to the access log. Then you include the access log for pwnage.
Implementation of Serpent is less likely to be subject to cache timing attacks than usual implementations of Rijndael.
It still takes a rather specific and improbable scenario for cache timing attacks to apply.
Many people will blabber endlessly about what should have been vs what happened, on any conceivable subject. It does not make them right.
The industry could have lived with Serpent instead of Rijndael. The perceived relative slowness of Serpent might have made AES adoption slower, though.
I'm trying to test the security features of different types of OSs available, and I decided to narrow this down to the Windows Phone 7 and iOS operating systems. I will be testing both my Nokia 800 and iPod Touch 4 to see which one has the better features. The issue I have now is figuring out how...
@Iszi I have no idea how to even start answering that question without my answer inherently being TL;DR. 'Has anyone here actually tested out embedded systems before?' well yes of course, don't we all? I agree it's 'overly vague' as you put it.
@Adnan You could head over to Math.SE and just hit 'edit' for any answer that has mathematical formulas in it. It might be same formatting for answers and comments for superscript, but I'm not sure you should test it... bah, beat me to it with a negative LOL
I conduct a weekly live-stream using Google Hangouts that streams over YouTube. Recently, the stream has been attacked by DDoSers. In an attempt to thwart such attacks, I have tried to keep my IP address secret [by not running Skype] and have even tried entry-level firewalls.
Are there any firew...
"How are they attempting to DDoS you? In fact, how did you know they are? You're streaming on Google Hangouts, so your IP is only disclosed to Google, right?"
I think we need a bit more information to determine what sort of a scenario we're dealing with. There's two possible fronts that could be getting attacked here - his connection to Google, and Google's connection to the subscribers. And of course, there's always the possibility that Google or his ISP are just having some hiccups on there end. Available solutions are dependent upon the nature of the problem. We really need more information for an accurate recommendation.
@Iszi I hope nobody gets me wrong, but can we assume that someone asking for security help on Security.SE is very likely not being attacked on the Google-subscribers front?
@Adnan Yup the question is way off or not disclosing enough information. They're supposedly DDoS-ing what IP? The one he's live-streaming from to YouTube? Also... Skype? Really? Using Skype isn't much different than DDoS-ing one self LOL. He doesn't need Skype to stream to YouTube, all he needs is a 'split cam' software, if he wants to stream to more than one client (i.e. to YouTube AND whoever he's in conference call with on Skype). No need to publish Skype address then.
@Adnan Any semi-decent split cam software has a capture option if he needs the stream from private Skype connection on YouTube as well
@Adnan Actually, I think that's the more likely front to be attacked. Why try to track down the origin of the stream (presumably private between the user and Google, as you've said) when the website hosting it is public?
I feel like we got off on the wrong foot. Due to me being an idiot miscommunication, a partial change snuck out early, and even though we announced it we didn't really explain why we made the change. So let me just start over...
We've made some changes to Close as Duplicate.
First, some back...
The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:
http://helpdesk.lastpass.com/account-recovery/
My question is, how can you have more than one password?
I thought LastPass derived the encryption key from your master password usin...
