Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto 101 – Introductory course on cryptography

crypto101.io

Post reply on HN
Print view View original

111–120 of 148 posts

Re: Crypto 101 – Introductory course on cryptography

#111

Post by 3131s »

SkyMarshal wrote: post #38
andrewflnr wrote: post #27

Earlier quoted context omitted.

Aikido in particular seems to be very subtle, both in my experience and the opinion of an aikido black belt I've asked about it. If you restrict yourself to aikido techniques and your attacker has no such reservations, you have to be extremely good. I think it would be a mistake to give up on self-defense in general because of that. In any case, you have to go into it knowing it's not a guarantee, it just increases y…

Yeah, I studied Aikido briefly in college and found it quite powerful when a petite 65yr old Japanese lady could inflict the most excruciating drop-to-your-knees pain I've ever felt with barely a touch. But it takes a decade or more of diligent practice to achieve that kind of skill, and I found Judo, BJJ, and Krav Maga quicker to become effective with.

Freestyle Olympic wrestling also has many useful techniques for winning a real street fight, and as an activity it builds the type of strength that is very effective in a fight. Worth taking a look at wrestler and BJJ practitioner Daniel Cormier's recent win of the UFC light heavyweight championship over Anthony Johnson, an extremely talented striker, to see why this is the case. Johnson essentially had a small window of time to knock Cormier out, and he nearly did, but once Cormier manage to get a hold of him the fight was brutal after that.

Strength training and general athleticism alone too will often allow you to win over someone who practices a martial art that is purely focused on striking, especially one of the more ornamental ones. Hard to win against someone that can just pick you up and slam you on the concrete ala Quinton Jackson.

Re: Crypto 101 – Introductory course on cryptography

#112

Post by lvh »

PeterisP wrote: post #107

The old Cryptopals challenges ( http://cryptopals.com/ ) seem to cover the same material in a pedagogically very different way - they don't feed you the information as this book does, but give you a practical task which can be easily done with e.g. reading the specification of an algorithm from wikipedia, but figuring out the implementation of the attack yourself gives a much better understanding than simply reading…

Hi! I'm the author. Also a big fan of Cryptopals; I was one of the reviewers for Set 8, and working with some of the authors. It's interesting to hear that point of view; because I thought C101 took the same approach as Cryptopals in the sense that it focused on teaching crypto by breaking it. When I say "learn by doing", I'm referring to stuff like walking through a bit-flipping attack just like cryptopals does. I recommend (and have organized/will be organizing) study groups where we work through cryptopals using Crypto 101; and I think that's a great idea. I was originally going to add exercises for C101, but honestly, Cryptopals was already that, and there wasn't much point in reinventing the wheel. I guess I should probably link to them?

Re: Crypto 101 – Introductory course on cryptography

#113

Post by marknadal »

eponeponepon wrote: post #3

This is about to eat my weekend, I think! :) Quite seriously, this is exactly what the tech world needs - personally, I know that in terms of understanding of crypto I'm streets ahead of the average Joe, but orders of magnitude behind people who actually know the field. I'm certain I'm far from alone in that set, but the way the world's going means that we with the generalised technical know-how have a moral impetus…

Same here, however I think it is better for us to talk about what we do know more, so that it increases the discussion and thus awareness and knowledge sharing (as well as getting corrected when wrong).

So we went out on a limb and made these 1 minute layman video explainers on cryptography: http://gun.js.org/explainers/data/security.html , I hope they are useful. Anything incorrect?

Re: Crypto 101 – Introductory course on cryptography

#114

Post by FullyFunctional »

lvh wrote: post #58
dom0 wrote: post #43

Earlier quoted context omitted.

To clarify: I didn't mean that people shouldn't learn or read about the topic, or try designing their own block or stream ciphers, hashes, KDFs and of course protocols (which are great fun!), not at all. Both my original comment and this one are directed at production use of cryptography.

Hi! I'm the author of Crypto 101. I couldn't agree more. I think the fact that we have so much crypto foot guns available is a UX issue that we should address. Ideally, Crypto 101 would only be to satisfy one's own curiosity; not mandatory reading for anyone who wants to do something cryptographic. Alas, that's also not the world we live in right now. Realistically, plenty of crypto libraries will offer up e.g. unaut…

Isn't this the point of [Twitter]NaCl (Bernstein et al)? To provide a library which, when used correctly, makes it harder to make the obvious mistakes?

I think it's great, but it doesn't solve the protocol issue.

Re: Crypto 101 – Introductory course on cryptography

#115

Post by Taek »

derefr wrote: post #98
stcredzero wrote: post #12

When I was taking Aikido, there was a day when the sensei was going through all of our techniques and showed how the uke (initiator of the attack, receiver of the technique) could turn things around on the tori . (receiver of the attack, initiator of the technique) It seemed like there were a half dozen ways each that a technique could go seriously wrong, and that many of them didn't require much skill, only determin…

I've always thought it would be neat to have something like the Netflix "Chaos Monkey", but rather than sitting around on your machines taking them down at random , it sits on your network (or as part of the offering of the PaaS you've deployed to) trying to break into your stack using Metasploit et al , and then will immediately shut down/isolate every piece of software it manages to gain access to. If you deployed…

I worry that this would give a false sense of security. Definitely it's better to have something that will highlight problems than to have the problems go unnoticed, but there's no way that something like a Penetrator Monkey could be comprehensive, and less experienced people might fall into the trap of believing that the monkey is as competent as an actual attacker.

Something similar happens with code coverage. It's pretty easy to write tests that provide 100% code coverage yet still miss basic bugs. 100% code coverage gives you little more guarantee than "this code doesn't crash for naive inputs" unless the tests providing the coverage were well written - code coverage gives you no introspection to how good the tests might actually be.

In short, I agree that this would be a cool + useful tool. But it should come with a disclaimer that it's not a substitute for more thorough testing + verification.

Re: Crypto 101 – Introductory course on cryptography

#116

Post by bogomipz »

tptacek wrote: post #55
qwertyuiop924 wrote: post #22

Can any crypto people here on HN verify that this gets it right?

I'm biased, since LVH is a partner at our new firm, but I've always liked his crypto writing. He's also a trained cryptographer.

Can you elaborate on his being a "trained cryptographer"? I'm not sure what that means.

Re: Crypto 101 – Introductory course on cryptography

#117

Post by bogomipz »

hannob wrote: post #47
seycombi wrote: post #4

This is currently on edx. Its more advanced that the courses mentioned here. I do not know what edx will do after the course ends, but if you want it you can get it while it ss still available. https://www.edx.org/course/quantum-cryptography-caltechx-del... Quantum Cryptography by Thomas Vidick (Caltech) and Stephanie Wehner (Delft University)

So-called Quantum Cryptography is largely snake oil. The most important things you need to know about it is that: * In order to do QC you need an authenticated channel first. QC proponents hardly mention that or try to obscure it, but it basically means you can't have QC unless you already have some other secure cryptography. * QC has severe practical limits. It needs a point to point connection capable of sending ph…

Is there a working and practical implementation somewhere? I was under the impression it wasn't practical yet.

Re: Crypto 101 – Introductory course on cryptography

#118

Post by tptacek »

bogomipz wrote: post #116
tptacek wrote: post #55

Earlier quoted context omitted.

I'm biased, since LVH is a partner at our new firm, but I've always liked his crypto writing. He's also a trained cryptographer.

Can you elaborate on his being a "trained cryptographer"? I'm not sure what that means.

He has a postgraduate degree in it.

Re: Crypto 101 – Introductory course on cryptography

#120

Post by bogomipz »

lvh wrote: post #88
zimmerfrei wrote: post #86

Maybe I am being too harsh, but it is clear the author does not have a formal education in the subject [0] nor any track in breaking non-toy crypto implementations [1]. This alone makes me a bit wary of any recommendation one may read in the material. There seems to be more attention to listing all the beasts in the cryptographic zoo than to the few fundamental tools required to really understand the mechanics (e.g.…

Hi! I'm the author. You're mistaken about [0] and [1]. I'd like to address your specific point about being a guide rather than a course. I agree that a crypto zoo would be a guide and not a course; although I disagree that either the book or the talk are a zoo. It's possible that that hasn't come through effectively enough. I could understand why someone might think that from looking at the table of contents for exam…

Congrats on your book, I'm looking forward to reading it. What was Rackspace's role or interest in the project?
Post reply on HN