359 reputation
bio website neal.mcburnett.org
location Boulder, CO
visits member for 3 years, 6 months
seen Jan 27 at 20:39

I do "Technology Serving Community" via free software.

Ubuntu member, Wikipedia contributor since 2002, ElectionAudits developer, Boulder Community Network co-founder, Android enthusiast, ex-Bell Labs web/security/standards maven....

See my web site for way more: http://neal.mcburnett.org/

comment How should I calculate the entropy of a password?
The context for the question is passwords in the face of attacks, as covered very well by Thomas' answer. As noted in Entropy (information theory), entropy is defined in the context of a probabilistic model. Clearly we should expect that an attacker is going to use a smart probabilistic model, so it is indeed the case that English words have less useful entropy in a password context than the same letters in a different order. We need to use more than the original "Shannon entropy", which has a different set of assumptions.
comment Who uses Dual_EC_DRBG?
Disproved by the announcement from RSA that their flagship BSAFE product uses it by default. Astonishing but true. A Few Thoughts on Cryptographic Engineering: RSA warns developers not to use RSA products
comment How to provide secure “vanity” bitcoin address service?
Thanks @pulpspy for completing that description. That makes it more expensive if you want to be able to find vanity in the check code part - 4 hashes for one address...
comment advances in usability for cryptography/authentication
Indeed. You beat me to it: how to decide between Cryptography.SE and Security.SE? - Crypto Meta - Stack Exchange
comment advances in usability for cryptography/authentication
This seems like a good candidate for migration to security.stackexchange.com