ctz

51 ms·

481.
by ctz 15y ago
- Website contains no details of the cryptography. - Stores private key by: a) SHA384-ing your passphrase, and choosing a sub-sequence of the output depending on one bit of the output (this is poor for brute-force resistance compared to PB-
482.
by ctz 15y ago
Checksums provide no security. Idea: protocol- and package-format-independent verification of packages, with trust rooted in DNSSEC of the ultimate source domain using DANE.
483.
by ctz 15y ago
This article describes a single affected start-up, but begins with "Why are so many start-ups being hit with account closures from banks in the RBS group?" That seems a little intellectually dishonest.
484.
by ctz 15y ago
I'm surprised Facebook and all its peripheral development has that much source. I would expect something like 5-10 million lines of code, not ~100 million lines implied by the example.
485.
by ctz 15y ago
I see an IP allocated to Google. How do you go from that to "google HQ"?
486.
by ctz 15y ago
Looks good now!
487.
by ctz 15y ago
Is the page layout broken for anyone else? (Me: Chrome 17.0.963.2 dev-m on Windows).
488.
by ctz 15y ago
Spoiler: because the image displays some x86 code (its RC4 with a fixed key), the image file itself contains the ciphertext (in a PNG iTXt block).
489.
by ctz 15y ago
Unfortunately, still no SDK and no sign of movement. This is really sad, as I'd love access to the Kindle's market.
490.
by ctz 15y ago
I'm guessing, with no evidence whatsoever, that this is an off-the-shelf desktop all-in-one running android x86. Something like http://www.ebuyer.com/281328-acer-aspire-z3101-aio-desktop-p...
491.
by ctz 15y ago
Let's be clear: the SSL/TLS protocol specifies no certification structure. This structure was built by the members of CAB in the relatively distant past. It /is/ possible to use TLS to make a genuinely good secure web. Unfortunately at th
492.
by ctz 15y ago
An entertaining and original way of removing PKCS#1 signature padding: var hDigestInfo = biDecryptedSig.toString(16).replace(/^1f+00/, ''); (Just a pity the signature verification function is broken by it.)
493.
by ctz 15y ago
On the second point, a strong cryptosystem wouldn't have such a poor security design that RSA could break into any of its customer's networks. I'm sure a number of other RSA customers were surprised that RSA retained this power; I was.
494.
by ctz 15y ago
Not really. SSL solely exists to authenticate domain names. Having 15USD and a domain name does not make you trustworthy. Likewise, code signing is an anti-tamper and publisher identification mechanism rather than anything which gives the
495.
by ctz 15y ago
"a SSL certificate isn’t a 100% gauruntee of safety" What have SSL certificates got to do with code signing? I have a feeling it involves speaking authoritatively on a subject you clearly don't understand ("properly-encrypted checksum" ind
496.
by ctz 15y ago
It also depends on the laws in your jurisdiction which will apply to you/your client. For example, in the UK: the DDA.
497.
by ctz 15y ago
You really think google adds private emails to its public index? Get real.
498.
by ctz 15y ago
Q10 is missing the correct answer: "someone inexplicably decided to implement part of the C standard library in C++". Not to mention the function's name will be mangled, making it unusable for C users.
499.
by ctz 15y ago
Counterpoint to the C++ fragment in "Error handling" section: void foo() { Matrix *a = new Matrix(1000, 1000); Matrix *b = new Matrix(1000, 1000); delete b; delete a; } Pretending exceptions solve error handl