Collaborate Disseminate
I notice that some cryptographic algorithms involve using XOR operation with the key (Even AES uses XOR to derive the round keys). My question is why specifically XOR? How about OR or NAND or some other logic operation. I bel… Continue reading The reason of using XOR operation in cryptographic algorithms
Let’s say I have a "corrupted" zip file from a potentially suspicious source, and that at least one person has attempted to extract it. Conventional wisdom used to be that bad stuff™ didn’t happen from unzipping a file, but could… Continue reading How can I tell if a zip file uses the 7-Zip exploit?
According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list:
Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. […] Microsoft is seeing … Continue reading Does Microsoft’s "Password Ban" list insecurely store user passwords?
Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists:
Pin mailer (this seems to be standard according to ISO 9564-1)
SMS
Email
Email a unique link, which can… Continue reading Pin delivery: SMS, mail, or pin mailer?
I have seen several offices with electric locks for entry that have a sensor for exit. I assume it’s some kind of motion or object detection sensor.
This is odd because in many cases, there’s a seam between the door it is … Continue reading Motion sensor door locks
We use sha1sum to calculate SHA-1 hash value of our packages.
Clarification about the usage:
We distribute some software packages, and we want users to be able to check that what they downloaded is the correct package, down… Continue reading Is sha1sum still secure for downloadable software packages signature?
We use sha1sum to calculate SHA-1 hash value of our packages.
Clarification about the usage:
We distribute some software packages, and we want users to be able to check that what they downloaded is the correct package, down… Continue reading Is sha1sum still secure for downloadable software packages signature?
I am well aware of the concept of CSRF, and I think I am also aware of the possible protection possibilities, as described by OWASP. However, I’m not sure why the synchronizer pattern seems to be preferred, if we could just as easily check… Continue reading Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF
I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on that same tutorial. This is confirmed i… Continue reading Cordova/Phonegap: RefreshToken in localstorage
Let’s say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse.
What’s to stop the user from changing the passwords (when they’re requ… Continue reading Sequential password updates