iuguy

59 ms·

541.
by iuguy 13y ago
Nope. The correct way to do this is to use a password based key derivation function like scrypt[1] or pbkdf2[2]. [1] - https://www.tarsnap.com/scrypt.html [2] - http://en.wikipedia.org/wiki/PBKDF2
542.
by iuguy 13y ago
As long as there are unsalted hashes or hashes that use predictable salting mechanisms in use, rainbow tables are far from obselete, functionally or otherwise.
543.
by iuguy 13y ago
Indeed, the best resource I've found for adversely affecting brute-force password cracking comes from the *coin cryptocurrencies. GPUs allow us to generate much much longer chains in rainbow tables than before. This means that there's a re-
544.
by iuguy 13y ago
Only really for the time being (and a considerable time to come, Quantum and Biological computing enhancements notwithstanding) but for a salt that big it makes far much more sense to use a key derivation function as you're effectively gene
545.
The Cloud Security Rules Book Review(securitybookreviews.eu)
1 points by iuguy 13y ago|0 comments
546.
Forensic Analysis of Tor on OS X(encrypted.cc)
1 points by iuguy 13y ago|0 comments
547.
by iuguy 13y ago
I'm in the middle of researching re-evaluating rainbow table attacks in light of Moore's law, GPUs and Crack (lookup) tables, I've also looked into countermeasures. What you're describing is partially correct. When you crack passwords (eith
548.
by iuguy 13y ago
I feel a little sad that you felt you had to send a video to demonstrate passion. Don't get me wrong, I'm not saying it was the wrong thing to do and it does show you're making a serious effort, but your talk should stand up on it's own mer
549.
by iuguy 13y ago
Sorry, that's 5 hours in addition to reading through each abstract, spending time checking linkedin, github and other profiles, watching videos of other talks they've done, doing due diligence to make sure the speaker's presence isn't going
550.
by iuguy 13y ago
Hmmm... I'm not sure I'd agree here. At 44Con[1] we get an average of between 100-150 talk submissions a year. Just reviewing all the talks once as part of the CFP panel is a herculean effort. If everyone had a 2 minute intro to their talk
551.
by iuguy 13y ago
Sounds like a normal day in Second Life to me. Just steer clear of the furries.
552.
by iuguy 13y ago
I think this is a smart buy. Buying netflix would be stupidly expensive, but buying Hulu and changing it to out-netflix netflix could be a really good play to pick up a platform fairly cheaply and run with it. The question is whether or not
553.
by iuguy 13y ago
To be fair the DEK-Info IV should be different for each key generated, so rainbow tables and other common precomputation attacks are pretty much out of the question. It's not as good as PBKDF2, but it's better than nothing and is probably w
554.
by iuguy 13y ago
Does anyone know how this compares in terms of performance to leveldb, lmdb and kyoto cabinet? I've been doing some potentially terabyte scale stuff and while another option is welcome I don't feel like re-integrating yet another local db t
555.
OWASP needs your help in compiling the Top Mobile Risks for 2013(owasp.blogspot.co.uk)
1 points by iuguy 13y ago|0 comments
556.
by iuguy 13y ago
I don't have a problem with the tool. If it helps people it's doing a good job. My problem is only with the article title overplaying it's utility somewhat.
557.
by iuguy 13y ago
I hate to be snarky but having read through the code this really isn't a big thing. It's a tool for people that can't use .ssh/config. Manage your SSH like a boss? Perhaps, but only in the pointy-haired can't-read-man-ssh_config boss sense
558.
by iuguy 13y ago
There's also this: http://thegreyhats.blogspot.co.uk/2013/03/so-i-have-two-rasp... And probably a few others around the Internet as well. Perhaps some enterprising person could come up with a laptop into which you plug in a raspberry pi?
559.
Descrambling the voice inversion scrambler(windytan.blogspot.co.uk)
23 points by iuguy 13y ago|1 comments
560.
by iuguy 13y ago
Without naming names or dropping people in it, things we've dealt with under the dickishness category: * Comments of an inappropriate sexual nature about people at the conference - warning * Getting stupidly hammered and talking about thing
561.
by iuguy 13y ago
Maybe it's different for security conferences (although I doubt it) but we have a simple rule at 44Con[1]: Don't be a dick. It's a very simple rule and it applies to everyone. If you're a dick, you're asked to stop being a dick. If you cont
562.
by iuguy 13y ago
Although to be fair it's different depending on where you go in the UK. Scottish degrees are distinctly more subsidised, and the situation in Wales is unlike England and Northern Ireland.
563.
by iuguy 13y ago
We looked into Reddit a while back for advertising. The two main problems we encountered were that much of reddit is the wrong sort of traffic - people that don't convert, people that expect something for nothing and get upset (and vocal) w
564.
by iuguy 13y ago
I came here to post this. Ultimately he needs to work out whether or not he can talk to his co-founders or not about this. If he can't it'll tear the relationship apart and it doesn't matter whether or not the company's making or losing mon
565.
by iuguy 13y ago
Using a pseudonym may be great, but there's always the temptation to be more abrasive, offensive or obnoxious when using one. The longer you keep an identity online in public forums the more information you tend to leak through side channel
566.
by iuguy 13y ago
Basically with a bit of work you should be able to implement something approximating a tty type interface over this, which means that you could (theoretically) sit in the car park running a metasploit session on an evil box hooked into the
567.
by iuguy 13y ago
During the summer I go on holiday to a remote island in the mediterranean where I sit on my patio atop a hill overlooking the sea and read for about a week. The only electronic devices I have are my e-book reader and a charger. Here's some
568.
How I Still Spoof Your Facebook App(breaksec.com)
2 points by iuguy 13y ago|0 comments
569.
Don't overwork. Don't be this guy.(business.asiaone.com)
1 points by iuguy 13y ago|0 comments
570.
by iuguy 13y ago
The amount they pay for bug bounties has just become worthless. The value of an XSS or even CSRF bug in Google products has just shot through the roof. I hope it works. If it does it'll have a massive impact on the world and hopefully utter

More ›