Introduction It’s important to understand that most of the password attacks to offline databases where only hashes are stored are extensions of either the brute force attack or the dictionary attack, or a hybrid combination of both. There isn’t really anything new outside of those two basic attacks. The combination attack is one such attack [...]
Introduction Before we start delving into the obscure attacks, it probably makes the most sense to get introduced to the most common attacks. The dictionary attack is one such attack. Previously we talked about the brute force attack, which is highly ineffective, and exceptionally slow and expensive to maintain. Here, we’ll introduce a much more [...]
Introduction For those who follow my blog know I have blogged about password security in the past. No matter how you spin it, no matter how you argue it, no matter what your opinions are on password security. If you don’t think entropy matters, think again. Entropy is everything. Now, I’ve blogged about entropy from [...]
A couple years ago, I wrote about how you can create a graphical representation of your OpenPGP Web of Trust. It’s funny how I’ve been keeping mine up-to-date for these past couple years as I attend keysigning parties, without really thinking about what it looks like. Well, I recently returned from the SCaLE 11x conference, [...]
It’s now been a full two weeks since I purchased my Yubikey and have been using it. The goal was to have a security token that I could use as a form of two-factor authentication for most if not all of my accounts. After two weeks of use, I figured I would write about it, [...]
I’m absolutely pedantic about password security with every one of my accounts. A couple of years ago, I watched as friends and family members seemed to have their Google, Twitter, Facebook or other accounts compromised. In every case, it was because they were using a weak password, and they knew it. I resolved to make [...]
Per my last post, I decided to setup an entropy server that the community could use. So, I’ve done just that. That server uses 5 entropy keys from Simtec Electronics in the U.K. as its hardware true random number generators. It hands out high quality randomness for the most critical cryptographic applications. The purpose, is [...]
With my last post about the entropy key hardware true random number generator (TRNG), I was curious if I could set this up as a server. Basically, bind to a port that spits out true random bits over the internet, and allow clients to connect to it to fill their own entropy pools. One of [...]
Recently, I purchased 5 entropy keys from http://entropykey.co.uk. They are hardware true random number generators using reverse bias P-N junctions. Basically, they time when electrons jump a depeltion zone in the junction, where a voltage is applied to the point of near breakdown. Basically, taking advantage of the random characteristics of quantum mechanics. There are [...]
I noticed that on my machine, my entropy was staying high, then falling off. Then, at what appeared to be some arbitrary point, it would fill back up, in a very periodic manner. This is, of course, after running haveged in the background. Curious, I started looking into it. It took a while to find. [...]
I admit that my last post sucked. I’ve been working on a few things that I want to blog about, but it’s going to take time to get all my ducks in a row. So, that post was mostly “filler”. Read as “I haven’t blogged in a while, and should probably put something up”. Sorry. [...]
I devised a system to use the one-time pad (OTP) using nothing more than a hard drive. It goes something like this: Meet in person with identical size hard drives. Encrypt the hard drive. File the drive with random keys of incrementing size. Devise an alorithm for using the keys. Unmount the drive. Enjoy the [...]
This is just a quick post about getting a fully kernel-space encrypted ZFS filesystem setup with GNU/Linux, while still keeping all the benefits of what ZFS offers. Rather than using dmcrypt and LUKS, which would bypass a lot of the features ZFS brings to the table, encryptfs is our ticket. The reason this is so [...]
This hand cipher was invented by cryptographer Bruce Schneier, and requires nothing more than a full 54-card deck of standard playing cards. Here is the basic idea, then we’ll get into the details. First, you need a standard 52-card poker deck of playing cards (4 suits, 13 unique cards per suit), with the two jokers. [...]
Two things are prompting this post. First, the recent leak of LinkedIn passwords, and second, family/friends’ email accounts getting hacked. It’s amazing to me how many posts there have to be on the Internet about password security, and how little attention people pay to them. One could say that many of the weak password demographic [...]
