moxie

50 ms·

361.
by moxie 14y ago
You also need the client and server to both support TLS compression. But there aren't any major sites (that I know of) which do support TLS compression.
362.
by moxie 14y ago
This article's conclusion is kind of a let-down, but I think the thrust of it touches on part of what bothers me about the Bay Area entrepreneur scene: the strangely myopic focus on "business" as the primary mechanism for "creating." If we
363.
by moxie 14y ago
Interestingly, that was the first time I'd heard of f-droid as well. =) I think my objections to f-droid are actually connected to the hesitations I have around a lot of what's happening in the "open" Android space. The "rooting" communit
364.
by moxie 14y ago
Yep, 50% chance of success. I'll probably be able to adjust this to 100% in the coming months, but in the current setup that's the maximum space we can cover for our estimate of the maximum price elasticity.
365.
by moxie 14y ago
There's also an in-between. Many CloudCracker users employ tools like KisMAC (which are fairly user-friendly) to get a capture, and then simply upload the output to CloudCracker (also fairly user-friendly).
366.
by moxie 14y ago
It's a pretty big keyspace, but not quite big enough these days. I haven't noticed any lack of uniformity across it, but I don't really have enough samples yet to be sure. We have a dictionary specifically for those devices, just because
367.
by moxie 14y ago
I run CloudCracker, so I can add some color. 'English' dictionary jobs use dynamic models built by password compromises from english speaking users, augmented by the results of our own jobs (as well as occasional brute force jobs we run ag
368.
by moxie 14y ago
Yep, in public compromises of large sets of WPA passphrases, more than 50% of them are phone numbers. This is why we offer a CloudCracker dictionary which includes every valid NANP number in it: https://www.cloudcracker.com/dictionaries.h
369.
by moxie 14y ago
It's also probably worth acknowledging that many organizations do use MS-CHAPv2 for their inner authentication credentials, precisely because they want to depend on it for mutual authentication instead of managing/deploying a PKI. Since the
370.
by moxie 14y ago
The way I see the relationship between Convergence and TACK is that Convergence is trying to provide trust agility for when we need to trust third parties, while TACK is trying to reduce the amount that we even need to trust a third party a
371.
by moxie 14y ago
Maybe you and I just haven't found the right frequency yet. =)
372.
by moxie 14y ago
I submitted the OSS build to the "Play Store" about 30 minutes ago, but it's still not visible. Seems like a caching bug in Google's stuff.
373.
by moxie 14y ago
Exactly, and I think it's possible that Mozilla just doesn't understand this. Webapps aren't attracted to identity providers because they want to avoid managing a user table in their database, but because existing identity providers like F
374.
by moxie 15y ago
Yep, I work close to an extremely high traffic OAuth endpoint. I think scrypt would probably "cost" a lot more in terms of actual servers required to operate it.
375.
by moxie 15y ago
I tend to think of this stuff from the cloudcracker.com perspective, which is all about cheap jobs rather than millions spent. I rarely do brute force because, honestly, it's rarely necessary. But the single biggest factor in cloudcracker
376.
by moxie 15y ago
This article doesn't feel very well done to me. He writes: "The first cipher I'd suggest you consider besides bcrypt is PBKDF2." PBKDF2 is not a cipher. It's a KDF, and it's almost always used with an HMAC or a cryptographic hash rather t
377.
by moxie 15y ago
You have to combine it with online access control protection: http://www.whispersys.com/screenlock.html But it also makes a data wipe easier to do securely, and gives you an additional last minute option when you see trouble coming (just
378.
by moxie 15y ago
Wow, if you're going to be a wingnut, at least be an interesting one. This guy appears to have employed a lifetime of wingnuttery in order to arrive at neoliberalism. That's a lot of effort in order to be a cheerleader for the status quo.
379.
by moxie 15y ago
If you seriously think that the passion of running a taco stand is more substantial and more liberating than the narrative which led to the events of Paris in May 1968, then I'm sorry for you.
380.
by moxie 15y ago
The author describes youth culture's social form by calling it "post-emotional," "entrepreneurial," and eventually "generation sell." As underwhelming as this is, I think it's incredibly generous, as I would call its social form simply "
381.
by moxie 15y ago
Hah, fair enough.
382.
by moxie 15y ago
They've been talking about it on twitter for weeks before this.
383.
by moxie 15y ago
Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into, but he's a smart cookie and I'm inclined to trust his assessment. I obviously ha
384.
by moxie 15y ago
No details about this attack have been made available to anyone who can publicly corroborate them, and yet the researchers are doing press interviews and speaking publicly about how they've broken SSL. I have no idea what the details of thi
385.
by moxie 15y ago
The problem is that right now, in the common case, the browser/OS vendors can't black-list individual CAs. Their ability to do so with DigiNotar is exceptionally rare, and would not be possible most of the time. Trust agility ensures tha
386.
by moxie 15y ago
I think that Dan is heavily invested in trying to "fix" DNS, and that he's arrived at DNSSEC as a way to do that. The problem for him, like most DNSSEC advocates, is that nobody cares about DNSSEC, and so it's not really happening. People
387.
by moxie 15y ago
In this case DigiNotar is being removed from browsers because nobody that lives in Mountain View happens to visit sites signed by DigiNotar. And aside from being Dutch, they're also unusually small (they only made 100k in revenue from cert
388.
Black Hat: SSL and the Future of Authenticity(threatpost.com)
6 points by moxie 15y ago|0 comments
389.
by moxie 15y ago
And I'm not sure that this would be enough, either. Crypto primitives are nice, but you still have to trust the webapp to deliver JS which calls those primitives every time you visit the webapp. I believe that this is again reducible to tr
390.
by moxie 15y ago
There's an interesting problem that is still unsolved in this space. Most people want JS crypto so that webapps can provide "end to end" encryption, relieving participants from having to trust the webapp service with their plaintext. The

More ›