"The Heartbleed Test" @ OWASP / NYU Poly

OWASP invited me to give a talk at NYU Polytechnic on Tue, June 24th 2014 about the story behind the https://filippo.io/Heartbleed test, how it worked and how it scaled from zero to performing 200 millions tests the first two weeks. Recording and slide deck are available. /* * * CONFIGURATION… »

Salt & Pepper, please: a note on password storage

Everyone will tell you that the best practice for password storage is [sb]crypt with random salt. Ok, we got that and even maybe got everyone to agree. But let me bump that up a notch: do you know what pepper is? The concept of peppering is simple: add a… »

On Keybase.io and encrypted private key uploading

One thing in particular of Keybase.io attracts a lot heat recently: they support uploading your encrypted key on their servers. This usually is pointed at as a mortal sin. Well, here is my private key, the untouched output of gpg --armor --export-secret-keys filippo.io | gpg --armor --clearsign. -----BEGIN PGP… »

Why Go is elegant and makes my code elegant

This is a enthusiast blog post. I'm not even gonna speak about how concurrency comes easy with Go. Honestly, I'm not good enough to speak about it. I'll just speak about how using Go in my everyday programming makes me happy. Go has elegance, good tools and has had the… »

My remote shell session setup

It's 2014 and I feel entitled to a good experience connecting to a remote server, instead the default still feels like telnet. After searching for quite a long time, I finally built my dream setup. These were the requirements: I want a single window/tab/panel of the terminal I'm… »

Native scrolling and iTerm2

tl;dr See the bullet points for the supported programs and the last paragraph for installation. Something I always wanted is native touchpad/mousewheel scrolling in all my terminal programs. MouseTerm hacks that into the OS X Terminal, but I am a iTerm2 user. I tried and gave up researching… »

How the new Gmail image proxy works and what this means for you

Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them. This, they say, will actually benefit users privacy. This might very well be true if images are prefetched when an email is received. The help page… »

The ECB Penguin

This is an image that has become kind of a cultural icon in the cryptography and InfoSec community. I'm speaking about "the penguin", a picture of the Tux Linux mascot encrypted with a block cipher in ECB mode that still shows clearly the outline of the original. .@solardiz @ErrataRob ECB… »