hunter

558 reputation

bio	website
	location	Madrid, Spain
	age
visits	member for	5 months
	seen	18 hours ago
stats	profile views	5

	558 reputation	bio	website		visits	member for	5 months
19 badges		location	Madrid, Spain		seen	18 hours ago

summary answers questions tags badges favorites bounties reputation activity

124 Actions

suggestions reviews revisions comments badges posts accepts all

May 14	comment	CSPRNG in JavaScript using Audio and Video Speaking of hacky - it's possible to leverage flash APIs via javascript: code.google.com/p/jpegcam . It's more likely that flash will be available on a user's system (excluding iOS, which is a big exclusion) as opposed to window.crypto.getRandomValues(), but if that's the case, then using a webcam might be redundant anyway as flash offers (as of v11) CS random numbers which give direct access to '/dev/random' ... more info here.
May 14	answered	CSPRNG in JavaScript using Audio and Video
Apr 10	revised	What does “adaptively secure” mean? Corrected the title's grammar
Apr 10	suggested	suggested edit on What does “adaptively secure” mean?
Apr 8	comment	Given a certain entrophy per character, how long should a passphrase be to guarantee key strength? This Wikipedia article is a good resource.
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? That makes sense - thanks for clearing it up.
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? Part of the question asks; "how is the mode of operation transmitted along with the encrypted file?". If you don't think I've answered that succinctly, then keep your upvote. If you think my answer is dangerously-misinformative, then downvote me. But frankly, I don't see much of a distinction between "Most systems have a predefined mode of operation", and @Poncho's assertion that "the mode of operation isn't usually explicitly transmitted in the ciphertext", yet I don't see you nitpicking his answer.
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? I see what's going on here...
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? Would encrypting the mode and algorithm add any significant security in the context you mentioned? Or is it simply a matter of convenience to store the mode/algo with the encrypted key (which must be encrypted)? I had understood that encrypting non-sensitive data (such as an IV, mode, etc) is generally discouraged.
Apr 7	comment	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher? I would quantify 'most systems' as there being more systems (at a guess) that use pre-defined protocols (version-dependent or otherwise) than those that don't.
Apr 6	answered	Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?
Apr 5	comment	How can mega store my login details and still be secure? Be reasonable. Nobody is asking anyone to reverse-engineer anything. If participants in this forum (especially new ones) can't ask questions such as: "How can they (mega) do this without compromising their encryption?" without being told to go away and ask someone else, then what is the point of the forum?
Apr 5	revised	How can mega store my login details and still be secure? trying to mitigate a $hit$torm
Apr 5	comment	How can mega store my login details and still be secure? "Doubly incorrect", you mean, like a double-negative? "Too time-consuming" is subjective, it depends on the attacker's patience, and what is known about the encrypted data. Anyway, in the interest of putting an end to this insufferable thread, I've edited my answer. Downvote if you disagree.
Apr 5	revised	How can mega store my login details and still be secure? trying to mitigate a $hit$torm
Apr 4	comment	How can mega store my login details and still be secure? And by the way - you're right about that link - the answer assumes brute-forcing 256 or 512 bits of high entropy psuedo-random data, but in fact the question is in regard to brute-forcing a low-entropy password.
Apr 4	comment	How can mega store my login details and still be secure? I was referring to using something like SHA256 or SHA512 as the underlying algorithm for a PBKDF, (as per my original answer), but re-reading, I can see that I should have made that clearer in my comments.
Apr 4	comment	How can mega store my login details and still be secure? Well yes, regardless of the hash algorithm used (MD5, SHA512, Keccak, or whatever), if the password is only 8 characters long then brute-forcing it would be trivial. Using a slow-hash such as PBKDF2 or Scrypt was mentioned in my answer, but given all this talk about brute-forcing hashes, it's worth underscoring it.
Apr 4	comment	How can mega store my login details and still be secure? @Ekris - SHA and MD were just being used as illustrative examples. Besides, the code you point to is executed client-side, it doesn't give any indication of what's happening server-side.
Apr 4	comment	How can mega store my login details and still be secure? Your logic assumes being able to brute-force the hash. Put simply, if Mega uses MD5 (doubtful), then the attack you describe is viable. If they use an industry standard (which they should) such as SHA512, then the attack you describe is not viable. Read the first answer here to learn why brute-forcing SHA512 isn't feasible.