Blog | 1Password

SECURITY
Authenticated Encryption and how not to get caught chasing a coyote
by Jeffrey Goldberg Jan 18, 2013
I introduced HMAC (Hash-based Message Authentication Code) through the back door when talking about the Time-based One Time Password (TOTP) of Dropbox’s two-step verification. But TOTP is actually a peculiar way to use HMAC. Let’s explore what Message Authentication Codes (MACs) are normally used for and why they play such an important role in the …
Continue reading
SECURITY
Doing the two-step until the end of time
by Jeffrey Goldberg Dec 20, 2012
In my discussion of Dropbox’s new two-step authentication, I skimped on the cryptography. Because we had to move quickly, I wanted to focus at the time just on our recommendations, so I told a few fibs about how the way the six digit codes “get” to your phone. Now I want to explain how it really works.
Continue reading
SECURITY
Alan Turing’s contribution can’t be computed
by Jeffrey Goldberg Dec 8, 2012
Alan Turing was born a hundred years ago this year and his most important paper was published seventy-six years ago (November 1936). It is close to impossible to overstate the influence that Turing has had on the modern world. It is something well worth celebrating his life throughout this centennial year. Although any celebration must be tempered …
Continue reading
SECURITY
Hashing fast and slow: GPUs and 1Password
by Jeffrey Goldberg Dec 5, 2012
The net is atwitter with discussion of Jeremi Gosney’s specially crafted machine with 25 GPUs that can test hundreds of billions of passwords per second using hashcat, a password cracking system. Password crackers, like hashcat, look at the cryptographic hashes of user passwords and repeatedly make guesses to try to find a password that works. …
Continue reading
SECURITY
Don’t trust a password management system you design yourself!
by Jeffrey Goldberg Nov 8, 2012
Nicole Perlroth of The New York Times penned an article on “How to Devise Passwords That Drive Hackers Away“. The article has a typical mixture of good advice that could often be better, along with some implied advice that I actually consider very poor.
Continue reading
SECURITY
Credit card numbers checksums and hashes, the story of a scamming attempt
by Jeffrey Goldberg Oct 18, 2012
As Lívia and I were out walking Molly and Patty on Monday evening, I received a telephone call from an unknown number.
Continue reading