atoponce

6 ms·

1.
by atoponce 3y ago
The source code is open source. Please point to the lines of code where the backdoor exists.
2.
by atoponce 3y ago
You can't get right/left balance metrics with a single pod. Several old metrics are now applied to both feet, so you can compare right to left. EG, if you notice your right leg spring stiffness increasing, but not your left, you k
3.
Triple-Parity Raid and Beyond (2009)(queue.acm.org)
7 points by atoponce 3y ago|12 comments
4.
by atoponce 3y ago
Biometrics aren't the second factor when using WebAuthn, the hardware security key is. But anyone with access to the security key can use the second factor. Biometrics would tie the key to you preventing them from being used by others.
5.
by atoponce 3y ago
2FA is rife with problems. FIDO2/WebAuthn isn't tied to biometrics and can be inconvenient. TOTP can get out of sync and can be phished. Email can also be phished. Voice and SMS are vulnerable to SIM swaps. Now we're seeing t
6.
by atoponce 3y ago
I was very disappointed in that Kickstarter. Yubikey ran a 54% off discount May 4th last year and not knowing when I would get my v2 SoloKeys, I purchased two. I had them within the week and have since integrated them into all my accounts.
7.
by atoponce 4y ago
Very structured with lots of very visible patterns in your JavaScript demo site. Some screenshots: https://imgur.com/a/2zQh4bA
8.
NIST Issues New Call for Post-Quantum Cryptography Digital Signature Schemes(csrc.nist.gov)
8 points by atoponce 4y ago|1 comments
9.
by atoponce 4y ago
His slides to his talk have been posted. I'll like the video to the talk when it's up. https://tobtu.com/blackhat2022/
10.
Bscrypt – A cache hard password hash/KDF(github.com)
2 points by atoponce 4y ago|1 comments
11.
SimpleX Chat – a messaging platform without user identifiers(github.com)
4 points by atoponce 4y ago|0 comments
12.
by atoponce 4y ago
It's not my repo, so I don't know. I don't see any specific criteria, so if you see a project missing that should be added, send a pull request.
13.
Curated list of KeePass-related projects(github.com)
3 points by atoponce 4y ago|2 comments
14.
Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security Keys on Systemd 248(0pointer.net)
4 points by atoponce 4y ago|0 comments
15.
Napa – a command line password manager based on libsodium(codeberg.org)
1 points by atoponce 5y ago|0 comments
16.
by atoponce 5y ago
> https://articles.59.ca/doku.php?id=pgpfan:tpp Some rebuttals to that critique outline that the author doesn't fully understand the arguments Thomas Ptacek laid out, and may have a simplified understanding of PGP:
17.
by atoponce 5y ago
I see. You're defining resynchronization of the register during decryption as recovery, not parity checks for recovering corrupted data. Fair enough.
18.
by atoponce 5y ago
What exactly is an OpenPGP recovery property? Can you point it out in the RFC?
19.
by atoponce 6y ago
The patents in question are https://patents.google.com/patent/US7949129B2/ and https://patents.google.com/patent/US8321675B2/
20.
OCB3 Patents Are Abandoned(metzdowd.com)
5 points by atoponce 6y ago|1 comments
21.
by atoponce 6y ago
> On the other hand, virtualization _already_ lets you run whatever arm64 BSD, Linux, or Windows that you want. The trackpad and everything else will work flawlessly thanks to guest additions. The OpenBSD kernel doesn't support load
22.
by atoponce 6y ago
No problem. I dig the project. Very cool. I would recommend the default be 6 words, and let people choose down to 4, but not lower. At last that way, users know what a "secure default" looks like. Granted, it breaks the four-word
23.
by atoponce 6y ago
Further, sufficiently seeded cryptographically secure RNGs are indistinguishable from true random white noise, so from a practical perspective, there is no point to require "true random".
24.
by atoponce 6y ago
I audit web-based password generators as a hobby, and this one does well. What it does well on: The source code is open source licensed. Passwords are generated in the client, not on the server. The generator is random. The generator is cry
25.
Over 72% of network traffic is encrypted(fortinet.com)
3 points by atoponce 8y ago|0 comments
26.
by atoponce 8y ago
Niceware ships 65,536 unique words. 3 words chosen randomly is 1 "password" of 281,474,976,710,656 possibilities. https://diracdeltas.github.io/niceware If that password was hashed with a single pass of vanilla MD
27.
by atoponce 8y ago
From my testing with Python's base64, hashlib, and passlib.hash modules, SHA-256 prehashing and base64 encoding is only approximately one one-hundredths the total execution time of bcrypt_sha256 for a 4 KB "password". This is
28.
by atoponce 8y ago
The sha256/512crypt algorithms, as well as md5crypt, hash the input based on each character in the password. This is why the execution time increases. bcrypt does not do this. bcrypt is constant-time, not because it truncates at 72 cha
29.
by atoponce 8y ago
> Seems like this can radically narrow the focus of a dictionary attack. It's leaking information, and we don't like this, but it's not fatal. 96% will have passwords less than 16 characters (see https://blog.
30.
by atoponce 8y ago
> Isn't the reason this is true that bcrypt just truncates the input at 72 characters? And if that's correct, aren't there basically a few options, any of which basically invalidate the argument? Let's run a scenari

More ›