ryan-c

35 ms·

391.
by ryan-c 9y ago
I'm tempted to write a cracker for shitty seeds people come up with, but given what I've heard of the design of IOTA, I'm afraid of getting brain damage trying to understand and reimplement their algorithms.
392.
by ryan-c 9y ago
Requiring users to choose a password as a seed for their keys is a catastrophically bad vulnerability. Is that really how IOTA works?
393.
by ryan-c 9y ago
> Actually one fun way of doing it is to run your own email setup using one of the big ESPs as a "proxy". I tried this with Mailgun, and it caused my mail to be marked as spam.
394.
by ryan-c 9y ago
"Casual Carpooling" at least used to be popular - you can read about it here: http://sfcasualcarpool.com/ Originally, for the East Bay to San Francisco trips, cash would not exchange hands because the Bay Bridge t
395.
by ryan-c 9y ago
The one that is simply called "Gorilla Glue". Not wood glue, super glue, epoxy, etc.
396.
by ryan-c 9y ago
I've done this before with gorilla glue (which is easy to find) on the spine, works fairly well.
397.
by ryan-c 9y ago
> This wouldn't work, as the attacker should know both from the database. You mentioned pregenerated lookup tables in a previous comment. Using email address as salt prevents that attack. Salts come with the database too. > Anywa
398.
by ryan-c 9y ago
You could simply have people use their email address (or name) as a salt. Not great, but it would help significantly. Eight character random mixed alphanumeric password, hashed with say, sha256: crackable in hours with a GPU cracking rig. E
399.
by ryan-c 9y ago
It absolutely would.
400.
by ryan-c 9y ago
The specific tool mentioned uses a trivial scheme. If I were trying to crack a large breach, I'd probably try running a few billion master passwords with that algorithm.
401.
by ryan-c 9y ago
I looked at the algorithm this thing uses - it's just base64(sha1([master password][alias])) with some data munging to deal with endian issues. Would be trivial to do GPU accelerated cracking.
402.
by ryan-c 9y ago
If someone suspects such a solution is being used, they can attempt to crack the master password. Combined with the weakness of this not supporting forced password rotation or varying complexity requirements well, it's really not a goo
403.
by ryan-c 9y ago
I owned an EeePC 900 which I believe used the same keyboard. I wouldn't even describe it as "good".
404.
by ryan-c 9y ago
I had an EeePC 900 back in the day, and used it as you described. I use my Chromebook in much the same way. I want a device with a nice screen that can run a web browser and a mosh client.
405.
by ryan-c 9y ago
> I don't know, but I still like the idea behind the "netbook": small, portable form factor with real keyboard, cheap machine, decent battery life, GNU/Linux. You and I clearly have very different definitions of &qu
406.
by ryan-c 9y ago
If you have cryptocurrencies, you should set up accounts on exchanges well in advance, and request substantial limit increases. Also, don't keep a balance you're on actively trading with on exchanges.
407.
by ryan-c 9y ago
They can run the laundering scheme with a rotation of however many decoy sites as they like. Making one site look like hundreds is not hard.
408.
by ryan-c 9y ago
You're wrong :-(
409.
by ryan-c 9y ago
They absolutely do, they just don't realize. There are a lot of schemes for "laundering" where the ad ran. Aside from popunder/redirect shenanigans that were covered in the press recently, they can iframe a "legit&q
410.
by ryan-c 9y ago
The same way I justify not having spent every cent I could spare buying BTC over the last eight years. I mined hundreds of BTC in 2011 to 2012, and sold pretty much everything as I went. If I'd saved it all, I'd have "fuck yo
411.
by ryan-c 9y ago
I've been taking a portion of my paycheck in Bitcoin (via bitwage) explicitly intended as spending money for a while. I buy things regularly with it. The payment flow using a mobile wallet is pretty great.
412.
by ryan-c 9y ago
I think someone once told me this story in person at a conference.
413.
by ryan-c 9y ago
The most likely explanation is blockchain.info trying to magically figure out how to import anything you supply, and the code decided to treat an address as a brainwallet since it didn't look like any known format of private key.
414.
by ryan-c 9y ago
I extract them from bitcoind's rpc interface by dumping blocks, but i started that process years ago. It'd take several months to dump everything from scratch at this point.
415.
by ryan-c 9y ago
Mining them using the eligius mining pool (which doesn't require registration, just a bitcoin address) over Tor would be pretty hard to link to an identity.
416.
by ryan-c 9y ago
I found that OpenVPN benefited greatly from setting larger tunnel MTUs and then allowing the IP packets to be fragmented. I think it's encrypting per-packet which is somewhat inefficient.
417.
by ryan-c 9y ago
People will pay for bespoke "vanity" addresses (this can be done securely or insecurely, the latter being a way of scamming people...), but those are not tied to any specific bitcoins. Another thing I've seen is mined blocks
418.
by ryan-c 9y ago
The "Universal ADB Driver" for Android devices[1] also installs a root CA, however it instead generates the CA during install, signs the driver, deletes the private key, then installs the CA and driver. 1. https://githu
419.
by ryan-c 9y ago
In my scan of the alexa top 1m domains in Aug 2013, there were 10 domains using 65337 and 54 domains using 65535. I suspect someone wrote bad instructions.
420.
by ryan-c 9y ago
Just as an example of how easy* it is for even experts to screw these things up, Viktor's followup email suggests that tools should enforce parameters. One of his suggestions: > exponent is unconditionally 65535 (F_4) The value for

More ›