354 reputation
211
bio website neal.mcburnett.org
location Boulder, CO
age
visits member for 3 years, 5 months
seen Dec 18 at 5:03

I do "Technology Serving Community" via free software.

Ubuntu member, Wikipedia contributor since 2002, ElectionAudits developer, Boulder Community Network co-founder, Android enthusiast, ex-Bell Labs web/security/standards maven....

See my web site for way more: http://neal.mcburnett.org/


Dec
16
comment How should I calculate the entropy of a password?
The context for the question is passwords in the face of attacks, as covered very well by Thomas' answer. As noted in Entropy (information theory), entropy is defined in the context of a probabilistic model. Clearly we should expect that an attacker is going to use a smart probabilistic model, so it is indeed the case that English words have less useful entropy in a password context than the same letters in a different order. We need to use more than the original "Shannon entropy", which has a different set of assumptions.
Sep
24
awarded  Autobiographer
Mar
28
awarded  Taxonomist
Sep
28
comment Who uses Dual_EC_DRBG?
Disproved by the announcement from RSA that their flagship BSAFE product uses it by default. Astonishing but true. A Few Thoughts on Cryptographic Engineering: RSA warns developers not to use RSA products
Jul
12
awarded  Yearling
Jun
10
awarded  Nice Question
Nov
24
awarded  Nice Answer
Jul
18
awarded  Teacher
Jul
18
answered What makes a hash function good for password hashing?
Jul
18
awarded  Critic
Jul
16
revised Taking advantage of one-time pad key reuse?
fix two typos
Jul
16
suggested approved edit on Taking advantage of one-time pad key reuse?
Jul
15
awarded  Talkative
Jul
13
comment How to provide secure “vanity” bitcoin address service?
Thanks @pulpspy for completing that description. That makes it more expensive if you want to be able to find vanity in the check code part - 4 hashes for one address...
Jul
13
revised How to provide secure “vanity” bitcoin address service?
check digits
Jul
13
awarded  Editor
Jul
13
revised What makes a hash function good for password hashing?
note in title it is a password hash
Jul
13
comment advances in usability for cryptography/authentication
Indeed. You beat me to it: how to decide between Cryptography.SE and Security.SE? - Crypto Meta - Stack Exchange
Jul
13
comment advances in usability for cryptography/authentication
This seems like a good candidate for migration to security.stackexchange.com
Jul
13
awarded  Scholar