Future Security

(Not that any program will be bug free. But exploits triggered by loading a malicious webpage can harm people much more easily than threats that require having a malicious process run alongside a password manager. That would be malware. And malware can target browser-based things as well.)

Paying for a password manager AND having your personal data collected AND using closed source software AND trusting a corporation to not be malicious or incompetent AND trusting the infrastructure of the web and CAs? That's not exactly as good as things get. Also see these security incidents (2016-2019). You're better off downloading KeePass(XC).

Didn't we used to have questions about how to use software on our off-topic list?

I didn't see your answer by the way. I was reading top to bottom. For that I'll add maybe swap "The salt could be a fixed value (e.g. empty)" with the caution warning at the bottom. I think it's better to show the more secure option up front and make the less-secure-but-okay-in-some-cases option the footnote.

Preimage, maybe is okay. But I'd guess you'd still need more bits of output. Less safe if you have a lot of different images to attack?

The success rate is too high, so the ratio of how much work an attacker needs to do vs what a normal user needs to do. High enough that it could push things over the "practical attack" threshold but the cost stretching factor would need to be so high that it would only work for some (or few?) applications.

It's increased, but I think it's only something you could count on in exceptional situations or extreme amounts of stretching. (The later of which isn't practical.)

That's what I thought you meant anyway.

Nevermind. Silly me.

I don't see how that makes a difference.

I'd just say "stretching" instead of "entropy stretching" because A) Entropy is not increased, B) Entropy isn't relevant for collision or other attacks.

@fgrieu Not useful if it's practical because the output is so short. Especially since the concern is collisions. Technically it makes it harder...

I think if you emphasize half your words, read ability is of course going to go down. I think italics are less readable for similar reasons to why upside down text is less readable. Plus one can underline their words more than once to make things more emphasized. Doesn't work when you try to make something more italicized. I don't think coloring links or anything else is a solution when you only have one color to use anyway.

Underlines are also less readable according to them. The one citation I found in my brief search was someone linking to a study of 14 people predating the existence of Firefox. It wasn't testing the readability of underlining in general. Rather underlined links vs colored links. The text they were asked to read, of course, was littered with links.

Turns out that underlines are not used because "they're ugly and not necessary anymore". No explanation for why italics are used.

HTML is usually rendered with "emphasized" text in italics and "strong" text in bold. It's encouraged to use <em> and <strong> instead of <i>, <b>, and <u>. Markdown has no underline option.

Guys. Why is it that everyone uses bold and italics? Why not bold and underline? (Other than the reason that it makes links hard to distinguish if the colors used to differentiate links from normal text doesn't appear distinct enough to a given person.)

I don't know where to look to see if stricter limits on noise bandwidth have been put on 5G since then, though. So there's some small chance that this is no longer a problem.

No. They noticed it and brought it to the attention of officials, but they rolled out 5G as scheduled anyway.

Absolutely. I can rest easy whether it was a temporary glitch or a mistake on my part. Bye.

I was multitasking a few minutes ago, so my memory is not reliable at all. So I don't know what I saw.

I closed the original tab. Maybe I goofed.

It's February now. I thought it was saying April before.

That's bad because it makes predicting both hurricanes and day-to-day weather harder. And we're hit by hurricanes frequently in the Summer.

@MaartenBodewes Here's a real issue with 5G. Water vapor can be detected using a specific frequency. The frequency range 5G takes up is close to that frequency. US regulations allowed carriers to broadcast noise into nearby frequencies up to a certain limit. With those rules it's okay for carriers to transmit signals in the range used for weather forecasting models.

Figured it was a glitch in the system and not in my brain or reality.

The one that the person on meta was referring to

@SEJPM Did you make that edit today?

And on my end the dates on other questions on crypto se seem fine.

Actually that dba question has it's first copy from April 1, 2016. The data on the question says "asked Feb 17 at 15:10"

web.archive.org doesn't have any copies of it unfortunately.

Ya. All the dates on my end show '16.

Only if the Bermuda triangle wanders the planet. Have the earth's magnetic poles finally flipped?

@MaartenBodewes No. I remember this question and this comment. I don't remember writing the other one. (But I did write it, as far as I know.)

Yes

Months ago

Also, the dates the webpage is show are not correct. I wrote that comment ages ago, I think.

Is that correct/fair?

I'll have to check how the entropy pool works now another time.

So... the RNG doesn't pull in more than 32 bits per block from RDRAND, but every time the RNG is reseeded (every 5 minutes) it pulls in sufficient entropy.

There's not intelligence or magic in those boxes we have. There are circuits, data, and liabilities.

People thought/think that it was their iPhone that did the voice recognition. Not a server farm. They don't realize their audio leaves their phone. They don't realize that a human really is going to hear a fraction of what gets uploaded because that's how businesses "improve our services".

It would at least be nice for people not to think that computers are magic. Know that they do what they're told, not what you intend. Know "algorithms" are as fallible as humans because they depend on data or have inherent systematic properties. Know that AI really sucks but we're having good luck faking stuff with neural nets at the moment.

Surprises for the programmer, surprises for the end user, and surprises for everyone doing business with an end user.

C is all about surprises though

To make hardware implementations simpler, I think. If you skipped those steps then you'd have to either make one round use a different setup from the rest or you'd have to conditionally apply the permutation. These were included in the design knowing that they don't affect security. (I don't know DES well at all, though.)

(I know that there are #defined limits, but no one actually includes code that checks that the range is large enough. And I know there are explicitly sized types now, but short, int, and long are still ubiquitous.)