zedshaw

54 ms·

571.
by zedshaw 16y ago
Yep, I wrote a bunch of C macros to prevent them and use them everywhere: curl http://zedshaw.com/dbg.h The main thing that caused defects was not handling default cases in logic. Things like not filling in the dangling else of an if-sta
572.
by zedshaw 16y ago
I wrote build scripts for my projects that tracked: 1. Syntax errors on compile (it was C). 2. Test failures. 3. Time of the run. 4. Lines of code. Then I used R to create graphs and reports that were generated periodically. About once an
573.
by zedshaw 16y ago
Sure, that'd be great. We should do t-shirts too. :-)
574.
by zedshaw 16y ago
Basically what Steve said in reply to you, but I'll also add that it is open source. I'm using the following library from the author of SRP: http://srp.stanford.edu/download.html as the backend implementation, and then you can see the
575.
by zedshaw 16y ago
This comes down to the contention between, using the terms I'm going with, a Customer and a User. Let's say you're logging into soawesome.com as a User of soawesome.com. That makes soawesome.com the "Customer", and you the User. Just to
576.
by zedshaw 16y ago
No, it's the best conversation because, unlike conversations with you, it brought legit testable things to test for and questioned basic assumptions I had based on actually looking at the code I'd made. E.g. A timing attack based on passwo
577.
by zedshaw 16y ago
I know he talks about it, but he doesn't really. He starts talking about it, and then switches to a browser environment attack. The main crux of my disagreement with you is that you say: Doing javascript in the browser makes it more vulner
578.
by zedshaw 16y ago
Yes, I do, but claiming I wrote the crypto in javascript is false. I wrote one part in javascript, and the other part is in C. That means, if there's an attack against the Javascript cryptography not the browser environment, then the mu
579.
by zedshaw 16y ago
Again, you say javascript cryptography is flawed, and then say it's a browser environment problem. Let's break this down. If the flaw is in how javascript does math, then that's something Autho.me has to deal with and I'd like to know abou
580.
by zedshaw 16y ago
I did read his post, but there isn't a single actual demonstration of his claims that javascript math is flawed: http://rdist.root.org/2010/11/29/final-post-on-javascript-cr... All of his exploits talk about attacks that are just browser
581.
by zedshaw 16y ago
You're also forgetting that the OpenID provider could be storing passwords and things wrong too, or that they've been hacked and someone's collecting them in-transit. Really, any attack against a non-OpenID site is available to an OpenID s
582.
by zedshaw 16y ago
Actually, he's incorrect. The crypto is calculated in javascript, and in a C library written by the author of SRP: http://srp.stanford.edu/download.html I'm using 2.1.2 with one slight modification to use SHA256 instead of SHA1+MGF1. Tha
583.
by zedshaw 16y ago
I don't have any problem with OpenID itself, and in fact I worked on the PIP project at Verisign briefly. That statement is more about the difference in design, that OpenID has been marketed as some kind of protection against evil sites.
584.
by zedshaw 16y ago
Again, if there's an actual demonstration of Javscript maths calculating incorrectly, then please give it. I'd like to make sure it's covered in the SJCL. Otherwise, this claim basically says that Javascript is either not turing complete o
585.
by zedshaw 16y ago
Actually, no that's not the point of autho.me. I know you keep thinking it's about me making a secure authentication that competes with bcrypt+ssl. It's actually for the purposes I laid out in the blog post: 1. An easy to setup secure aut
586.
by zedshaw 16y ago
I'll put in my vote for hackety-hack as well. I'd also say that, if you want her to be awesome at programming, then force her to take piano lessons (or any instrument). There's a very strong correlation between music skills and coding,
587.
by zedshaw 16y ago
I don't use OpenSSL in software I wrote if I don't have to. :-)
588.
by zedshaw 16y ago
Ad hominems are totally alright in my book, especially since everyone loves doing them to me and then bitching when they're done back. For example, your post doesn't have a single link giving counter evidence. You'd think you could bring s
589.
by zedshaw 16y ago
I doubt Jacob is hacking his own code, he'd have way too much to lose and I do believe he actually loves the project. If he were to do anything it'd be handing interesting traffic off various exit nodes he and friends control to Wikileaks.
590.
by zedshaw 16y ago
Oh, it's pretty much impossible to have any rational conversation these days. The majority of the technology speech these days is manipulative, flat out wrong, very anti free speech, and hyperbolic. When you start from that, there's just
591.
by zedshaw 16y ago
Thomas is very right, but I was more interested in my reasons why I don't use Tor based on all the crap I see going on around it.
592.
by zedshaw 16y ago
WOW. So usable. I'm sure everyone who doesn't trust his affiliation with Wikileaks will just sit right down and punch that in.
593.
by zedshaw 16y ago
I was curious about this, so I started googling for how to do this. Sure enough, it's a bitch and the only way to really do it easily is to use a GUI like Tork. Not to mention I can't seem to figure out how you find his nodes in order to
594.
by zedshaw 16y ago
Hmmm, yeah that's possible, but I'd have to actually implement it and then try to hack it before I could give it any kind of blessing.
595.
by zedshaw 16y ago
Yep, programmers will screw this up, and that's where good docs and good easy to use implementations come in. I also believe there's a market for auditing people's use of services like this. At the point where programmers can screw it up y
596.
by zedshaw 16y ago
Yeah, very very true. I've said for a while that the quality of example code and the "linguistic usability" of a service or API is a major influence on what a programmer does.
597.
by zedshaw 16y ago
You know what Thomas, you're right I'm being douchey. I'll work on making this a bit better, and report on what I find. Thanks for your comments so far.
598.
by zedshaw 16y ago
Like I keep telling you, this isn't any more or less secure than any existing solution because the browser is not secure in the face of an attack. Even with HTTPS if I can inject some javscript then it's a one-liner to get your password. S
599.
by zedshaw 16y ago
I'd have to look at it more, but I think doing the 2nd factor auth before a simple password auth will have problems. What you really want is they login like normal, but then they get a txt message or use an app on their phone to do the 2nd
600.
by zedshaw 16y ago
Your proposed solution doesn't solve your complaint of browser security. Even if you use SSL and have a bcrypt hashed database, once someone gets onto the browser they can get at any password typed. It is literally a 1 liner if they have

More ›