sweis

32 ms·

301.
by sweis 16y ago
This is insecure. It is using Unix time as a nonce for CTR mode: https://bonchat.org/js/aes.js Clients may send messages encrypted with the same keys and overlapping counters. This could allow the server to recover information on the mess
302.
by sweis 16y ago
Synopsis: Ben Laurie proposes Nigori, a protocol and open source implementation for storing secrets in the cloud. It doesn’t require you to trust anyone. The storage server(s) are incapable of getting hold of the keying material. Users just
303.
Nigori: Storing Secrets in the Cloud(links.org)
2 points by sweis 16y ago|1 comments
304.
"If you’re outraged by accidental breaches, you’d better sit down"(benlog.com)
58 points by sweis 16y ago|19 comments
305.
by sweis 16y ago
This paper discusses some usability challenges of PGP and end-user encryption in general: "Why Johnny Can't Encrypt" http://www.gaudior.net/alma/johnny.pdf
306.
by sweis 16y ago
The data on the drives and the cameras are evidence in an ongoing criminal investigation. Law enforcement needs to establish and maintain a chain of custody of that evidence, and ensure that it's not tampered with. They will likely pull the
307.
by sweis 17y ago
The problem with this is that people inadvertently send password resets when they forget their account name. This happens all the time. It is a pain because the recipients freak out that someone is trying to break into their account. If tha
308.
by sweis 17y ago
There has been a lot of work in the last 10 years on search over encrypted data. Some of the more practical schemes do operate similar to how you describe; searching over encrypted indices. For example, check out Chang & Mitzenmacher's
309.
by sweis 17y ago
Despite using encrypted channels, web applications can leak contents through side-channels. For instance, the response size of query auto-completion can reveal what you're searching for.
310.
Side-Channel Leaks in Web Applications(research.microsoft.com)
1 points by sweis 17y ago|1 comments
311.
by sweis 17y ago
The wiki page has more information and is on the Google code site. I'll just delete this since the other thread has more informative comments.
312.
by sweis 17y ago
This sends the file in transit over SSL, but encrypts the data at rest on EC2. That means you must completely trust EC2. Worse, based on the comments in the blog, it is unclear who has the key that is used to encrypt the files: hotzyco: "Wh
313.
by sweis 17y ago
"Every time this page is displayed, our server generates a unique set of custom, high quality, cryptographic-strength password strings which are safe for you to use" This is comedy gold.
314.
by sweis 17y ago
Are you looking for referrals for companies to perform an external security evaluation or are you looking to hire engineers with security experience? If security is "absolutely critical" to your product, you probably need both.
315.
by sweis 17y ago
No, you would need to manage your own secret key. That's why it's hard for most people to use in practice.
316.
by sweis 17y ago
Just adding support isn't going to popularize PGP. Every major IMAP client supports S/MIME, but few people use it. Usability is still a key barrier. Read "Why Johnny Can't Encrypt": http://gaudior.net/alma/johnny.pdf Users must generate t
317.
by sweis 17y ago
I messed around with analyzing US senate votes using a SVD several years ago: http://saweis.net/svd/
318.
by sweis 17y ago
How would users identify which proxies are safe? There are already dishonest proxies being operated with the intent of monitoring who uses them. I think using Tor is safer.
319.
by sweis 17y ago
This reduces to the same problem of trusting a single third party with your search queries. If I understand correctly, a corrupt or compromised GoogleSharing proxy could leak your searches. This is not a hypothetical threat. There are alrea
320.
by sweis 17y ago
This is sad. He was a co-worker of mine. Here's more info: http://nyulocal.com/on-campus/2010/01/13/nyu-computer-scienc...
321.
by sweis 17y ago
That depends on what you want to learn and what your goals are. Some of the most fascinating aspects of mathematics and computer science only exist in books and papers. That being said, I think it's perfectly valid to focus strictly on the
322.
by sweis 17y ago
I was going to recommend Matt Blaze's crypto.com as a better resource, but it was apparently moved to the CDT and is now dead.
323.
by sweis 17y ago
There are lattice problems that we don't know how to solve efficiently in the quantum model yet. Under some plausible conjectures, certain learning with error problems would be hard in the quantum model. Quantum complexity is an open and on
324.
by sweis 17y ago
Another fully homomorphic paper recently on eprint: http://eprint.iacr.org/2009/616 It's also on HN: http://news.ycombinator.com/item?id=995203
325.
by sweis 17y ago
Paper by van Dijk, Gentry, Halevi, and Vaikuntanathan. Abstract: "We construct a simple fully homomorphic encryption scheme, using only elementary modular arithmetic. We use Gentry's technique to construct fully homomorphic scheme from a "b
326.
Fully Homomorphic Encryption over the Integers(eprint.iacr.org)
2 points by sweis 17y ago|1 comments
327.
Bacteria engineered to convert carbon dioxide into isobutanol fuel(nature.com)
1 points by sweis 17y ago|0 comments
328.
by sweis 17y ago
Congrats to J.D. and Aaron.
329.
by sweis 17y ago
Google had already found a viable business model when this article was written. They were profitable in 2001 and went on to make $99M in net income on $348M in revenue in 2002. This was not public knowledge at the time since Google was stil
330.
by sweis 17y ago
Try the top search term under "Implementations": http://lmgtfy.com/?q=quantum+cryptography The Swiss ran a long-distance quantum crypto network this year for over 12,000 hours: http://www.swissquantum.com/ I think BT was running a quant

More ›