41–50 of 76 posts
As far as doing it wrong can we go back to "app ‘A’ set a cookie with your account ID in it" and discuss why on Earth the app works like that???
Earlier quoted context omitted.
It's a Louis CK bit, and an inside joke because the bit does match up with Intelligentsia (there's actually one of those in LA, where LCK wrote the bit, so I've always wondered). Our office is in fact a few floors up from the Intelligentsia in the Monadnock building.
Very cool. I have always wanted to start a Haskell consultancy and run it out of that building ;)
Earlier quoted context omitted.
Throw that book away, and buy Ferguson and Schneier's "Practical Cryptography", which Schneier contributed to in penance for writing "Applied Cryptography". Portions of the proceeds of "Practical Cryptography" are donated to a fund that helps the people who wrote crypto based on "Applied Cryptography".
What in particular is wrong with "Applied Cryptography" ?
Thanks, Thomas. I just finished implementing my own crypto in a webapp I am working on. (AES, with Diffie Hellman for a shared secret we needed) You've made me so nervous about everything I thought was true that I did a hg revert and am looking at gpgme bindings. You've done a good deed, I think.
Diffie Hellman is also remarkably easy to screw up. Here's an old post of mine I don't think ever made it on to Hacker News: http://www.matasano.com/log/962/adam-bozanovich-did-not-unco...
Hm. I wrote this for our normal blog readers, who live and breathe security stuff, so I don't know how well it'll carry here.
You blogged the shit outta that post! Definitely an interesting read even for crypto dilettantes. Perhaps, especially for crypto dilettantes. I took Rivest's Computer and Network Security class in college and the most important takeaway for me, far outstripping all of the interesting technical content, was "Don't implement crypto."
Hm. I wrote this for our normal blog readers, who live and breathe security stuff, so I don't know how well it'll carry here.
Earlier quoted context omitted.
Diffie Hellman is also remarkably easy to screw up. Here's an old post of mine I don't think ever made it on to Hacker News: http://www.matasano.com/log/962/adam-bozanovich-did-not-unco...
Off topic of the main thread, but isn't the attack mentioned in that post still problematic if you can't reliably act as a MITM for a whole session, but you can disrupt the session long enough to confuse both sides into agreeing on an insecure session key?
Isn't the whole problem in this situation that you are trusting the client with critical data? He takes possession of it, has unlimited time and opportunity to work on it, and successful falsification will be obvious for him? Why on earth trust the client with the data in the first place? I have never liked the "encrypted cookie" way of handling session storage. Just have a server side session store and all of this c…
Also processes vs threads was just another interview question, it was only slightly more relevant to the story than unicorns in space.
What's the best battle-tested library (and call) for implementing exactly that, without making any of the common mistakes?
I don't understand what's so hard about encryption. There are simple, well-known rules (except the timing one that is sort of news), and if you follow them you should be safe, no? 1. Use a blocks-size unique prefix (IV) for each message (random will do as well) 2. SHA-256 your entire message before encryption and add the hash value at the end to prevent tampering 3. Use AES-256 with chaining to encrypt 4. Use SHA-256…
Almost everything you wrote just now has problems. 1. Has a well-known problem, which is why "Practical" suggests using a nonce. 2. SHA-256'ing a known plaintext doesn't authenticate a messge. In fact, even simply taking a secret key and appending it to your message before you SHA-256 the message isn't secure; there's a reason HMAC is as complicated as it is. 3. This whole blog post was about things that go wrong wit…
Anyways, re padding - what if I hash the padding as well? surely an attacker would not get anything of value by playing with it?
Thanks