Random musings
One of the most important properties of a cryptographic hash function is that of “Strong collision-resistance“, that is, it should be "computationally infeasible" to find distinct inputs x1, x2 such that hash(x1) = hash(x2). For the SHA-1 hash function, which generates a 160 bit hash, to have strong collision resistance, only a brute force attack … Read more
I am a happy customer of Ola. I decided to try Uber. I installed the Uber app on my wife’s Android mobile and tried to register with her email address and got the message "Email address already in use". I don’t recall registering with Uber and thought that my wife had done so. However, a … Read more
I read an article titled Frequent password changes are the enemy of security which I find misleading and missing the point. In this article, Carnegie Mellon University professor Lorrie Cranor, who became chief technologist at FTC challenges FTC’s advice FTC’s advice: Encourage your loved ones to change passwords often, making them long, strong, and unique. … Read more
There is no substitute for detailed code reviews, more so if the code is related to security. Any changes to such code, however minor, should be reviewed. However, in addition, it also helps if the compiler, tools etc can help in flagging potential errors. Take the case of the very serious security error in ios/mac … Read more
If you work in the computer security area, it is like drinking from the fire hose, what with the daily revelations about snooping and spying by the NSA. So much to talk, write and discuss. Comedians (and their writers) get excited when interesting politicians become newsmakers, as it makes their jobs much easier and more … Read more
If you are not using lastpass to manage your passwords, you should. I had written some blog articles on lastpass. Now lastpass has added support for using Google Authenticator as the second factor in multi-factor authentication. The first factor in the 2-factor authentication is "what you know" which is a password — the master password … Read more
About a year ago, I had sung praises of lastpass in my blog article. Yesterday, lastpass said that based on some traffic anomalies, they suspect that part of the encrypted database may have been retrieved by the bad guys. You may know about this as lastpass is asking every user to a) validate their email … Read more
The number of passwords one needs to remember just keeps going up. My initial
solution of storing them in an encrypted file was obviously not very convenient. I used [keypass](http://keepass.info/) for a while. But I wanted a solution that can be used from any browser. I found [lastpass](https://lastpass.com/) and it is just the perfect solution.