Top all-time · #3434
thái
Personal blog · vnhacker.blogspot.comsecurityprogramming
thái is a personal blog at vnhacker.blogspot.com about security and programming. Since 2008, 21 different Hacker News readers have linked it 35 times, most often “Fairy tales in password hashing with scrypt”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
Security and privacy write-ups, linked by commenters as references on password hashing and scrypt, Google Allo message encryption, and session hijacking. Commenters cite them as sources rather than praising them.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Việt kiều yêu nước mắm
Most-linked posts?
- Fairy tales in password hashing with scrypt3 people · 3 mentions · first linked 2014-04-19
- Why JavaScript Crypto Is Useful3 people · 3 mentions · first linked 2014-06-18
- On Studying Mathematics2 people · 2 mentions · first linked 2019-08-21
- Exploiting the Diffie-Hellman bug in socat2 people · 2 mentions · first linked 2016-02-04
- How the BEAST was Born2 people · 2 mentions · first linked 2011-09-26
- Security and Privacy in Google Allo2 people · 2 mentions · first linked 2016-05-19
- A history of elliptic curves in tweets2 people · 2 mentions · first linked 2020-09-05
What Hacker News says?
You don't need to use p or q. See http://vnhacker.blogspot.com/2014/04/idea-to-solve-cloudflar...
Comment linking /2014/04/idea-to-solve-cloudflare-heartbleed.html
on “CloudFlare's Heartbleed challenge cracked”Submitted So you want to roll your own crypto? as a story · 186 points
HN discussionRemind me this one http://vnhacker.blogspot.com/2011/09/beast.html
Comment linking /2011/09/beast.html
on “Fun with your friend's Facebook and Tinder sessions”Submitted Vietnam's contact tracing app broadcasting a fixed ID as a story · 107 points
HN discussionIt's https://vnhacker.blogspot.com . I rarely blog in English. However, right now there's a pretty good post: https://vnhacker.blogspot.com/2020/04/vietnams-contact-traci... .
Comment linking /2020/04/vietnams-contact-tracing-app_26.html
on “A Graduate Course in Applied Cryptography”Submitted A history of elliptic curves in tweets as a story · 54 points
HN discussionIt's the end-to-end part that is opt in. Normal messages are encrypted in transit and while stored and only the machine learning system has access to them otherwise. https://vnhacker.blogspot.com/2016/05/security-and-privacy-i... Of course that means it is just Google policy protecting the messages internally and it probably isn't resistant to a warrant, but the messages are protected from other access.
Comment linking /2016/05/security-and-privacy-in-google-allo.html
on “If you care about privacy, you should not use Google Allo”Submitted Fairy tales in password hashing with scrypt as a story · 53 points
HN discussionHa. This is probably something that we mountain view folks would enjoy working on :-). I've updated my blog on how to recover the private key from the CRT parameters stored in the private key: http://vnhacker.blogspot.com/2014/04/idea-to-solve-cloudflar... . Trivial math, but still interesting to see how it actually works.
Comment linking /2014/04/idea-to-solve-cloudflare-heartbleed.html
on “Willem Pinckaers on Akamai's flawed OpenSSL allocator patch”Submitted Flickr's API Signature Forgery Vulnerability as a story · 19 points
HN discussionInteresting coincidence. I just wrote http://vnhacker.blogspot.com/2014/06/why-javascript-crypto-i... , in which I explain the threat model implied in the Matasano's article doesn't apply to most applications.
Comment linking /2014/06/why-javascript-crypto-is-useful.html
on “A Criticism of JavaScript Cryptography”Submitted Why JavaScript Crypto Is Useful as a story · 16 points
HN discussionThe recent post "Fairy Tales in password hashing"[0] in regards to scrypt seems somewhat relevant here. [0]: http://vnhacker.blogspot.com/2014/04/fairy-tales-in-password...
Comment linking /2014/04/fairy-tales-in-password-hashing-with.html
on “Please stop hashing passwords”Submitted You want to encrypt password hashes as a story · 11 points
HN discussion> These functions belong to a family of functions known as key derivation functions: they use hashing to produce a digest which is suitable for use as a password hash. KDFs are not for storing password hashes, they are for key derivation. This is a subtle point, the main thing is to use KDFs as KDFs (to derive keys that are then used to encrypt data). Details in the first link here (the second is about common mistak…
Comment linking /2014/04/fairy-tales-in-password-hashing-with.html
on “Storing Your Data Securely: A Primer”Submitted A history of elliptic curves in tweets as a story · 11 points
HN discussionSubmitted Exploiting the Diffie-Hellman bug in socat as a story · 11 points
HN discussionSubmitted How the BEAST was Born as a story · 8 points
HN discussionSubmitted A quick audit of CryptoCat's elliptic curve crypto as a story · 7 points
HN discussionSubmitted Why JavaScript Crypto is Useful as a story · 5 points
HN discussionSubmitted Advisory: Security Issues in AWS KMS and AWS Encryption SDKs as a story · 3 points
HN discussionSubmitted Security and Privacy in Google Allo as a story · 3 points
HN discussionSubmitted Potential data breach in the Bay Area? as a story · 2 points
HN discussionSubmitted The Internet of Broken Protocols: Showcase #9 as a story · 2 points
HN discussionSubmitted On Studying Mathematics as a story · 2 points
HN discussionSubmitted Exploiting the Diffie-Hellman bug in socat as a story · 2 points
HN discussionSubmitted A Whirlwind Tour of Galois Theory as a story · 2 points
HN discussionSubmitted Vietnam: A Hacker's Report as a story · 2 points
HN discussionSubmitted An idea to solve the CloudFlare Heartbleed challenge as a story · 2 points
HN discussionSubmitted The Internet of Broken Protocols as a story · 1 points
HN discussion
