Tom's Random Thoughts

Thank you, its fixed now.

2011-07-26T04:08:12.903-07:00

Thank you, its fixed now.

github link does not work

2011-07-26T03:35:56.401-07:00

github link does not work

http://blog.lastpass.com/2011/05/lastpass-security...

2011-05-05T07:05:41.821-07:00

http://blog.lastpass.com/2011/05/lastpass-security-notification.html

Solution: a.) Choose a token large enough to make ...

2011-03-18T11:10:25.558-07:00

Solution:
a.) Choose a token large enough to make brute-force attacks less interesting
b.) Avoid the birthday attack by matching 1:1 instead of 1:n by also using the user-ID for the token look-up.

@cristian: Google does not find anything (except my blog entry) for "birthday attack forgotten password" Do you have any pointers?

Yeah, this kind of bug is pretty common in web app...

2011-03-18T09:36:54.456-07:00

Yeah, this kind of bug is pretty common in web applications.

what other kind of measures you suggest other than using >= 16 bit entropy and those you mention ?

I thought about some kind of HMAC where "secret" is known only to the application and bound someway to the particular user.

The birthday attack is so effective because the ch...

2011-03-18T08:52:44.728-07:00

The birthday attack is so effective because the chance of a collision increases with each attempt. However, unless the web app allows more than one token per user, at some point you will have generated tokens for all users and the chance of a collision per attempt will be constant from then on. So a sufficiently long token (token space must be significantly larger than the number of users) with a one token per user limit would also be safe.

Yeah, but the amount of trust I have to put in it ...

2011-01-29T12:38:15.603-08:00

Yeah, but the amount of trust I have to put in it is reasonable, fundamentally if they did the crypto correctly, nothing leaves my computer unless locally encrypted with AES256..it is enough for me at least ;-)

Well everyone has to decide for her/his own if s/h...

2011-01-29T01:51:21.360-08:00

Well everyone has to decide for her/his own if s/he trust such services. Same for OpenID providers which might violate your privacy.

Something like lastpass.com can also help users to...

2011-01-28T06:53:34.800-08:00

Something like lastpass.com can also help users to produce strong passwords requiring them to use and remember only one strong master pass.

2010-11-03T02:20:01.929-07:00

This comment has been removed by a blog administrator.

Maybe the audience would have been bigger at the o...

2010-10-30T04:30:47.616-07:00

Maybe the audience would have been bigger at the openSUSE conference ;-)
Of course I can't guarantee full seats, but I would really like to have such a workshop at the next conference.

Hey Rasmus, hope you and your family are fine! Fo...

2010-10-27T01:52:53.397-07:00

Hey Rasmus,
hope you and your family are fine!

Fortunately I cultivated my long-winded presentation style so well over the years that the audience falls asleep before even recognizing it is boring. :)

Bye
Thomas

Well, there does not seem to be a lot of interest ...

2010-10-27T00:39:48.262-07:00

Well, there does not seem to be a lot of interest in security. Is it your presentation style or lack of marketing for the event? ;-)

Hello Sascha, nice blog. Your assumption is wrong...

2010-10-27T00:33:41.902-07:00

Hello Sascha,
nice blog.

Your assumption is wrong. It was not my intention to hide the code. If this would really hurt someone, I wouldn't talk about it until a solution is found.

Cheers,
Thomas

Maybe you should've changed the code more? Oth...

2010-10-26T09:21:57.105-07:00

Maybe you should've changed the code more? Otherwise its rather easy to guess where this issue may be comming from ;-)

If your C code can't drop elevated privileges,...

2010-07-24T06:52:16.670-07:00

If your C code can't drop elevated privileges, you should use access() to verify any file references of behalf of regular users

Hi Andreas, it happens by accident, but I will lea...

2010-07-23T13:46:38.938-07:00

Hi Andreas, it happens by accident, but I will leave them there because they do not cause much damage. :) Cheerio!

Great and laconic articles. Thank you!

2010-07-23T12:42:57.738-07:00

Great and laconic articles.
Thank you!

Indeed nice articles! I'm sorry i had to move ...

2010-07-23T07:25:15.868-07:00

Indeed nice articles! I'm sorry i had to move them into the SDB:

So they are

http://en.opensuse.org/SDB:Secure Coding Checklist: C and C++

http://en.opensuse.org/SDB:Secure Coding Checklist: Ruby on Rails

please update your links would you? thanks

Great articles but why do you have English article...

2010-07-23T04:35:51.190-07:00

Great articles but why do you have English articles in the German wiki?

The one about secure C programming is a very nice ...

2010-07-23T04:09:22.595-07:00

The one about secure C programming is a very nice post (I don't use Ruby so I didn't read the other one).
Thank you very much, it is so useful.

http://lists.opensuse.org/opensuse-factory/2010-05...

2010-05-26T10:17:50.892-07:00

http://lists.opensuse.org/opensuse-factory/2010-05/msg00170.html

is it faster then before?

2010-05-24T09:53:35.159-07:00

is it faster then before?

Ok, here's a start at a selinux policy (src rp...

2010-05-13T11:40:30.678-07:00

Ok, here's a start at a selinux policy (src rpm) for openSuse 11.3 Milestone 6:

https://build.opensuse.org/package/show?package=selinux-policy-05042010-1.src.rpm&project=home%3Aalanrouse

You can boot to a desktop in enforcing mode (one AVC however). From that point almost everything that would be useful is prohibited.

Enjoy!

Once you have a working policy, it should do the s...

2010-05-11T12:30:44.796-07:00

Once you have a working policy, it should do the setsebool init_upstart=1 for you.

I'm working on it...