Random musings
Security is only as good as the weakest link. Example: You have installed a very strong lock on your front door. A potential intruder will look at the strong lock and go to the back of the house and find a weaker lock to pick. Also, one should be able to quantify what a "very … Read more
A good friend of mine called me with this question: You work in computer security, right? I want to login to this website called xyz.com. Can anyone intercept my communications? I ask: 1) Are you using https://xyz.com, and not http? He replies: Yes I ask: 2) Are you logging in from a browsing center using … Read more
Rolling your own crypto is a bad idea — we should leave this to experts though even they get it wrong quite frequently. In general, one can safely use standard crypto algorithms and ciphers provided you follow the requirements carefully. Many require cryptographically strong random numbers — if this property is not satisfied, attackers can … Read more
Web Assembly is a low level portable binary format (bytecode) for a stack-based virtual machine is a W3C web standard, that runs in a sandbox, on all major browsers runs nearly as fast as native machine code, and enables high performance applications on the Web language, hardware and platform independent (unlike Java applets and Flash) … Read more
Cryptographers and Security Researchers have a penchant for coming up with colorful acronyms and names which describe, in brief, the vulnerability or exposure. Some are them are BEAST, CRIME, ShellShock, SLOTH, POODLE, Lucky 13, Sweet32, Smurf, Petya, BlackNurse, FREAK, DROWN, BREACH, LOGJAM, HeartBleed, CloudBleed, TicketBleed, Fireball, CLOAK and DAGGER, WANNACRY, SambaCry, HIDDEN COBRA, BroadPwn, Blueborne, … Read more
One of the most important properties of a cryptographic hash function is that of “Strong collision-resistance“, that is, it should be "computationally infeasible" to find distinct inputs x1, x2 such that hash(x1) = hash(x2). For the SHA-1 hash function, which generates a 160 bit hash, to have strong collision resistance, only a brute force attack … Read more
I am a happy customer of Ola. I decided to try Uber. I installed the Uber app on my wife’s Android mobile and tried to register with her email address and got the message "Email address already in use". I don’t recall registering with Uber and thought that my wife had done so. However, a … Read more
I read an article titled Frequent password changes are the enemy of security which I find misleading and missing the point. In this article, Carnegie Mellon University professor Lorrie Cranor, who became chief technologist at FTC challenges FTC’s advice FTC’s advice: Encourage your loved ones to change passwords often, making them long, strong, and unique. … Read more
Elliptic Curve Cryptography: computing shared key If Alice and Bob want to exchange encrypted messages, they need to first agree on a Key. This shared key (also known as symmetric key) will be used to by both parties to encrypt messages. There are many ways of arriving at the shared key (including the old fashioned … Read more
There is no substitute for detailed code reviews, more so if the code is related to security. Any changes to such code, however minor, should be reviewed. However, in addition, it also helps if the compiler, tools etc can help in flagging potential errors. Take the case of the very serious security error in ios/mac … Read more