Viewing profile — Jfreegman

Wikipedia is anything but neutral on political topics. Their political bias comes straight from the top with corrupt administration and disproportionate application of their own ru…

There have been 6 releases in the past year, including a major feature merge. https://github.com/TokTok/c-toxcore/releases https://github.com/TokTok/c-toxcore/pull/2269 Tox is deve…

At the time I read it, I found myself hating the book and its characters, yet unable to put it down. It wasn't until long after I had finished the book that I realized that there w…

>Every password that becomes public knowledge ends up in credential stuffing lists, whether it matches your password policy or not. That's right. And we don't want to produce passw…

Why doesn't it? If that password became public knowledge, then it certainly does exist in lists and tables. Its high entropy is only protective as long as it remains secret. This i…

You missed my point again, and your tangent on randomness is unnecessary; I have no misconceptions of how randomness works, and it is precisely that understanding that has lead me …

>No Yes. For example, if a rainbow table contains a match for "a" repeating 500 times, then that password's entropy is a non-factor. Therefore entropy in of itself does not necessa…

Increasing entropy mitigates brute force attacks but not necessarily rainbow table attacks, hence the distinction. If every user had a unique password, rainbow tables would be rend…

>But you can, apparently, force them to use passwords that meet whatever other weird criteria you choose. No one is forced to use the random password generator, and even if I set a…

Small correction: the password that has been seen 12 times is "aaaaA1" (no ! char). But "agkxA1" has still been seen 0 times.

>If you use passwords of a small enough size that this would really be a problem (like four digit PINs or your "aaaaA1!" example) then your password isn't delivering adequate secur…

I agree that there are risks either way, though like you said, the threat model is a bit different. SpicyPass isn't explicitly for web passwords. It's just a generalized key value …

That's a great question, and I wish I was good enough at math to give you a sophisticated answer. But my thinking is that the entropy you might gain by allowing duplicates is negat…

The pass source code you linked to is just a wrapper for the unix toolset (and has twice the byte count, not that it matters). Pass has a completely different crypto implementation…

Although that sentence refers to the interface and feature-set, not the language on which it's built, I do tend to avoid the more complex features of C++. Is there anything in part…

Third party browser extensions (and cloud syncing) are two things that, while convenient, create potential security holes. I opted for security over convenience with spicypass. I a…

Often it just comes down to personal preference. A necessary feature to one person is bloat to another. Git integration for example is not something that meets my criteria for a ne…

According to the libsodium docs: >The string produced by crypto_pwhash_str() already includes an algorithm identifier, as well as all the parameters (including the automatically ge…

My motivation for writing spicypass was actually a frustrating struggle I once had trying to get pass to play nicely with my GPG installation. I decided it would be easier (and mor…

Far from having comparable resources to billion dollar space and nuclear corporations, FOSS developers often have no funding at all and work entirely in our spare time, for free. A…