sarciszewski

6 ms·

1.
Show HN: CMS Airship – Secure Content Management for the Modern Web(github.com)
3 points by sarciszewski 10y ago|0 comments
2.
Show HN: CMS Airship – Secure Content Management for the Modern Web(github.com)
1 points by sarciszewski 10y ago|0 comments
3.
Show HN: 13 Open Source Projects for June 13(paragonie.com)
4 points by sarciszewski 10y ago|0 comments
4.
Ask HN: How does your company handle application security?
2 points by sarciszewski 10y ago|0 comments
5.
Solve All Your Cryptography Problems in 3 Easy Steps(paragonie.com)
1 points by sarciszewski 10y ago|0 comments
6.
A Primer on the Cryptography Powering Our Upcoming Open Source CMS(paragonie.com)
3 points by sarciszewski 10y ago|0 comments
7.
by sarciszewski 11y ago
(Switching back to my old account because rate limits.) I wouldn't ever use something like FizzBuzz to assess a candidate. It would be more of "here's a mostly finished sample application with a corresponding SQL file, add th
8.
by sarciszewski 11y ago
> All true but my observation is that the companies that put candidates through multi-day-out-of-town interview processes can afford to miss out on the candidates that can't do it. All companies can afford to waste less money than
9.
On the Design and Implementation of a Stealth Backdoor for Web Applications(paragonie.com)
2 points by sarciszewski 11y ago|0 comments
10.
by sarciszewski 11y ago
> RSA security depends mostly on how you build your private keys and ECC security depends on what parameters and what curve was chosen. No. RSA security depends on getting your parameters right and padding. http://www.cryptofa
11.
by sarciszewski 11y ago
I really appreciate the level-headed discussion in this thread so far, especially the comment I'm replying to. It's a stark contrast to the CFRG mailing list. (At least, so far, no one has tried to derail discussion here with &quo
12.
by sarciszewski 11y ago
http://pastebin.com/AYW682BJ https://archive.is/exvT2
13.
by sarciszewski 11y ago
Person: "I'm starving and barely able to get by working for Yelp in SF." Yelp: "You're fired." (Good luck paying rent without a job.) Yelp CEO: "The cost of living is too high here, so we're going to
14.
by sarciszewski 11y ago
How would transforming it before sending it over the wire help here?
15.
by sarciszewski 11y ago
No, it's one-way cryptography, but it's not a form of encryption. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
16.
by sarciszewski 11y ago
Cryptocat was not secure. No argument there! Decryptocat was the proof in the pudding. If a secure product could be as user-friendly as Cryptocat was while still being secure, then most peoples' communications would be more secure. T
17.
by sarciszewski 11y ago
See: "but the execution was flawed." > Security at the expense of usability comes at the expense of security. It got the usability part down, it just wasn't secure. And I wasn't claiming it was.
18.
by sarciszewski 11y ago
Cryptocat was a good concept (i.e. it was USABLE!), but the execution was flawed. It grew a lot of criticism and Nadim made mistakes in handling some of his critics, creating a schism between him and the cryptographers who might have been a
19.
by sarciszewski 11y ago
Warning: Autoplay video.
20.
by sarciszewski 11y ago
"shoulder surf protection"?
21.
by sarciszewski 11y ago
No, you're saying "which of this limited set of companies are you going to authenticate with" instead. If you don't want to be guilty of taking users' agency away from their own trust decisions, you need to do one o
22.
Bookmarklet: Remove Wired's annoying “anti-adblocker” veil(gist.github.com)
4 points by sarciszewski 11y ago|0 comments
23.
by sarciszewski 11y ago
> I don't understand why they would trust <crappy forum owner> over a dedicated authentication storage place but that's their choice. What if <crappy forum owner> happens to be a security engineer, and <crappy fo
24.
by sarciszewski 11y ago
My question was: "What if your users don't trust any of the existing providers on Earth?" It's hard to make a blanked recommendation like that, even for "only 99%" of websites. Neither you, nor the person build
25.
by sarciszewski 11y ago
This requires your users to trust whichever OAuth providers you decide to integrate with. Sometimes, the set of "trusted OAuth providers" for your users is {}. What then? > 99% of the websites that "require" me to cre
26.
by sarciszewski 11y ago
If you're using any of: PBKDF2, Bcrypt, Scrypt, Argon2, then you're fine. Our recommendation is: 1. Use the best option available, but 2. We provided example code in multiple languages for the best one that's
27.
by sarciszewski 11y ago
I did say "morally equivalent" rather than "technologically equivalent". By that, I mean the overall security of your password scheme is analogous to what people get out of a password manager.
28.
by sarciszewski 11y ago
This is morally equivalent to using a password manager to encrypt your passwords with a "master password". :)
29.
by sarciszewski 11y ago
What do you do if your name is Dread Pirate Rogers and the set of OAuth providers you and your customers trust is "None"?
30.
by sarciszewski 11y ago
https://paragonie.com/blog/2016/02/how-safely-store-password... How does that look now?

More ›