Reputation
359
Top tag
Next privilege 500 Rep.
Cast close & reopen votes
Badges
2 11
Impact
~5k people reached

Dec
16
comment How should I calculate the entropy of a password?
The context for the question is passwords in the face of attacks, as covered very well by Thomas' answer. As noted in Entropy (information theory), entropy is defined in the context of a probabilistic model. Clearly we should expect that an attacker is going to use a smart probabilistic model, so it is indeed the case that English words have less useful entropy in a password context than the same letters in a different order. We need to use more than the original "Shannon entropy", which has a different set of assumptions.
Sep
28
comment Who uses Dual_EC_DRBG?
Disproved by the announcement from RSA that their flagship BSAFE product uses it by default. Astonishing but true. A Few Thoughts on Cryptographic Engineering: RSA warns developers not to use RSA products
Jul
13
comment How to provide secure “vanity” bitcoin address service?
Thanks @pulpspy for completing that description. That makes it more expensive if you want to be able to find vanity in the check code part - 4 hashes for one address...
Jul
13
comment advances in usability for cryptography/authentication
Indeed. You beat me to it: how to decide between Cryptography.SE and Security.SE? - Crypto Meta - Stack Exchange
Jul
13
comment advances in usability for cryptography/authentication
This seems like a good candidate for migration to security.stackexchange.com