Writing about security
Five write-ups on what the standard security advice is actually worth: how long a password really holds, why a passphrase beats a word with symbols jammed into it, what a hash is and is not, how a 2FA code can be right on two devices at once.
Security
How to Verify a Download You Did Not Expect
A matching checksum says the file arrived as published. Whether it is the file you should run depends on where the checksum came from, and on checks that come before any hash.
Read
Security
MD5 vs SHA-256: Which One and Why
MD5 is broken the moment someone chooses the input on purpose. SHA-256 is not. MD5 still catches an ordinary corrupted download.
Read
Security
How Password Managers Generate Passwords
A random byte from the same secure source your browser uses for encryption keys, filtered until every character is equally likely.
Read
Security
What a Hash Function Is, and What It Is Not
A fixed-length fingerprint for any amount of data: useful for exactly three things, and useless for a fourth that people keep trying.
Read
Security
Password vs Passphrase: Which Is Actually Safer?
Four random words beat a short scrambled password. Four words you chose yourself beat almost nothing.
Read
Security
How to Send Someone a Password Securely
Never send the secret and the key to it down the same wire. What that looks like in practice, and what it still does not protect you from.
Read
Security
How Long Would It Take to Crack Your Password?
The honest answer is "it depends who is attacking", and the spread between the best and worst case is about sixteen orders of magnitude.
Read
Security
How Authenticator App Codes Work (6-Digit TOTP)
Your authenticator app never receives anything. It does the same arithmetic the server does, and the numbers happen to match.
ReadWhere to start
Start with passwords against passphrases. It is the piece most likely to change what you do, and it settles with arithmetic an argument usually conducted with opinions: four random words beat a short string of symbols, and the reason is countable.
Then how long it takes to crack a password, which puts real figures against the vague warnings, and what a hash is, which underpins the rest of the category.
What these pieces have in common
Security writing tends to run on fear, and fear is a poor guide because it does not help you decide what to do first. The pieces here use numbers instead. How many guesses does this actually take. What does a breach of a password database expose, and what does it not. Why does a six-digit code that anyone could shoulder-surf still help.
They also try to be clear about where a safeguard stops. MD5 against SHA-256 is about an algorithm that is broken for signatures and still fine for spotting an accidentally corrupted file. How two-factor codes work explains why those codes resist a stolen password and not a convincing fake login page. Sending a secret safely is mostly about the channel rather than the encryption.
Frequently asked questions
Is a passphrase really stronger than a complex password?
Usually, and the maths is straightforward. Four words chosen randomly from a list of 7,776 give about 51 bits of entropy, which beats a typical eight-character password with mixed symbols. It is also far easier to remember, which matters because unmemorable passwords get written down or reused.
Why do two-factor codes change every thirty seconds?
The code is generated from a secret shared once at setup plus the current time, rounded to a thirty second window. Both your device and the server compute it independently, so nothing is transmitted when you log in, and a code someone captured is useless within half a minute.
Is MD5 safe to use for anything?
For detecting accidental corruption, yes, and it is fast. For anything where someone might deliberately create a second file with the same hash, no: that attack has been practical for years. Signatures, password storage and integrity checks against a motivated attacker need SHA-256 or better.
All categories
PDF 10Images 10Text 14Design 11Calculators 13Developer 20Everyday 4Time 7