Viewing profile — earthrise

This post really needed to be written -- I get this question a lot, too. I like the blind indexes concept, it saves you from having to find some weird deterministic encryption mode…

Security is half a technical problem and half a usability problem (for developers). We need more emphasis on the usability half. For example, we should be doing everything we can t…

The salt would need to be kept secret so it shouldn't be called a salt, it should be called a key. The benefit of Scott's solution compared to this is that you don't need to deal w…

I usually consider this a "vulnerability" in the sense that the author probably intended to use AES and so they may have misunderstood the mcrypt API. Most importantly, they might …

Yeah, when I made this program two years ago I never intended it to be taken this seriously. I added a big disclaimer to the readme.

Hi everyone, I'm the author of that software. I really didn't want this to blow up. It's absolutely NOT a solution to getting raided by the police. While that was the original insp…

Say we're trying to download the PHP source code from php.net. If all that's protecting us is SSL, then if an adversary compromises the php.net servers (happens all the time, and a…

I've written down some general principles we should follow, but any reasonable implementation of them seems pretty far off: https://defuse.ca/triangle-of-secure-code-delivery.htm t…

Steve Gibson is working on a system called "SQRL" that does exactly that, and should be very usable: https://www.grc.com/sqrl/sqrl.htm edit: forgot some words

Here's the rough process I followed when I did that audit: https://defuse.ca/b/hwwW9d3FkPGhM4T6xBIbhf I think the reason I found so much in only 10 hours is that I had a good set o…

In cryptography, the burden of proof is on the one proposing the system. It's up to the system designer to prove it secure. The reason why we stick to things like encrypt-then-HMAC…

This is a bullshit challenge. The attack model in which it is set is nothing like the theoretical models cryptographic systems are designed to be secure against, and even less like…