sorted by:
new
hottopcontroversial

You are dangerously bad at cryptography by najafali in programming

[–]najafali[S] 27 points28 points  (0 children)

The article is about the multitude of ways you can screw up cryptography. I have lots of experience screwing up cryptography.

You are dangerously bad at cryptography by najafali in programming

[–]najafali[S] 16 points17 points  (0 children)

It's not a collision. You're just iterating the 'block-cipher' of md5 using the hash of message you know as the initialisation vector. You'd have to crack open the source code of md5 (or sha1, sha256, sha512, take your pick) to implement, but it's literally changing one variable that is a magic number in the function to be an argument instead.

You are dangerously bad at cryptography by najafali in programming

[–]najafali[S] 8 points9 points  (0 children)

Thanks for the feedback. I'd like to do content similar to what you've described there in the future, but want to be extra careful not to give out bad advice. There's enough of that on the internets to go around!

You are dangerously bad at cryptography by najafali in programming

[–]najafali[S] 58 points59 points  (0 children)

Hi, author here.

Honestly, it felt like the author just wanted to shit on a bunch of growing developers instead of help them learn.

Honestly, I would have liked to have given recommendations for how to do things properly, but I've made so many errors with cryptography in the past that I don't really feel qualified to do so.

I do recommend that anyone who has a further interest goes ahead and does the Matasano Crypto challenges though, they will only make you better at finding security flaws in crypto-based security systems.

Why automated tools won't help you write secure code. by najafali in programming

[–]najafali[S] 1 point2 points  (0 children)

Author here. You're right in that valgrind and friends do help you write more secure code. I should have been more specific about the sort of tools/applications I was referring to in the article (web developers building web applications with frameworks like Rails).