🅿🅸🆇🅴🅻

  • 2 Posts
  • 16 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • He wanted to be popular with the regular, poor people. He was throwing money left and right but always denied where his wealth came from. He wanted to come across as a self-made, honest man. Some believed it, or just weren’t willing to accept the atrocities he was capable of. He was overthrowing the government, blaming it for everything that was bad in Colombia, and wanted to appear as a savior, hence the contrast he was creating by wearing simple outfits in certain public appearances. But he did also wear suits and shirts that were considered tasteful and fashionable at the time.










  • If on Linux and need automatization, GnuPG works, and you can use RSA keys. It’s slower than symmetric for large files, but I had success encrypting several tens of GB database backups with a 2048 bit key with no issue. The higher key length you go, the slower. But it has the advantage that you only need to keep the public key on the machine you are encrypting on, and keep the private key safely stored away for when you need to decrypt. Unlike for symmetric, when if you need repeatable / automatized encryption, and you’d store the key in a config somewhere on the same machine in plain sight, and because it’s also used for decryption, when leaked you’re done for.

    Normally you would go with symmetric and generate a good, random AES key each time you encrypt, use AES for actual encryption which is very FAST, and encrypt just the AES key with RSA / asymmetric. This complicates scripts a lot and you end up with 2 dependent files to take care of (the target encrypted file and the file with the encrypted AES key). But this is the sane way of doing it because asymmetric isn’t ment for large data lengths (not just because of slow speed). HTTPS and SSH work the same way: asymmetric for key exchange handshake (through public certificates), symmetric for the actual communication while oftenly changing the key.

    If no automation is necessary, use VeraCrypt containers. You can keep multiple files in a container. You have several symmetric algorithms to pick from and you can control the number of iterations for key derivation. Debatable as to the added security, but you can also choose to chain up to 3 algorithms in your preferred order.

    The above covers the tools and somewhat the algos. For key lengths, see here. I wouldn’t go with RSA lower than 4096 these days, elliptic curves is preffered (256 bit +), or AES 256+ in CTR mode. And I’d stay away from lesser known / scrutinized algos.

    As others have stated, any recommendation depends on your threat model, how powerful and resourceful are the bad actors you are trying to protect from, how often you need to encrypt, how often to decrypt, the time span for which you need to protect the file, etc.




  • It depends on how the password is stored / KDF used (what type of hash, salting, bcrypt, etc).

    Judge for yourself if it’s an old website or old piece of software that might use (god forbid) MD5. Since one would not normally know that, I’d go with 20 (good, cryptographically) randomly generated upper/lower/digits if using a password manager, or 40ish characters passphrase if you need to remember and/or easily type it. Add some punctuation / special chars (spaces, commas, dots, paranthesis, etc) if it’s an important masterkey (ie password manager key, encrypted container, etc) and you have decent typing skills.

    Some shitty sites / routers don’t accept certain special characters hence go with upper/lower/digits as standard but use longer lengths (if the shitty site allows you and doesn’t limit that too). Limits to what a password should contain and/or length limits would be a sign of lazy programming and poor password management, so treat them as unsecure from the get-go (yes, even big names like Oracle have piss-poor security or lazy implementation). Good programming nowdays shouldn’t have those limits, as user input sanitization / injection protection exists, and hash functions have a fixed length no matter what the input length is.

    Also very important, don’t reuse passwords for online accounts. Hence a password manager remembering them for you. There are still websites storing passwords in plain text. You wouldn’t want your local pizza hut know or leak your email password by being hacked.