• 0 Posts
  • 914 Comments
Joined 1 year ago
cake
Cake day: June 30th, 2023

help-circle

  • With the hash one, it doesn’t look like that could be exploited by an attacker doing the bad hashing themselves, since any collisions they do find will only be relevant to the extra hashing they do on their end.

    But that encryption one still sounds like it could be exploited by an attacker applying more encryption themselves. Though I’m assuming there’s a public key the attacker has access to and if more layers of encryption make it easier to determine the associated private key, then just do that?

    Though when you say they share the same secret, my assumption is that a public key for one algorithm doesn’t map to the same private key as another algorithm, so wouldn’t cracking one layer still be uncorrelated with cracking the other layers? Assuming it’s not reusing a one time pad or something like that, so I guess context matters here.




  • I remember hearing to not layer encryptions or hashes on top of themselves. It didn’t make any sense to me at the time. It was presented as if that weakened the encryption somehow, though wasn’t elaborated on (it was a security focused class, not encryption focused, so didn’t go heavy into the math).

    Like my thought was, if doing more encryption weakened the encryption that was already there, couldn’t an attacker just do more encryption themselves to reduce entropy?

    The class was overall good, but this was still a university level CS course and I really wish I had pressed on that bit of “advice” more. Best guess at this point is that I misunderstood what was really being said because it just never made any sense at all to me.






  • Could consider the AI itself to be art, any by extension anything it produces is a part of that art.

    Though, combined with the other commenter’s point about it involving work from the prompter as well (or “work” tbf, since not all AI output requires tweaking if you get lucky), makes me wonder.

    If someone creates a tool that is a work of art and another person uses that tool to create another work of art, how much of that 2nd work belongs to the 2nd artist and how much belongs to the tool maker?

    Same thing with skills and technique. I got better at doing random landscape paintings after watching Bob Ross do it. I applied the techniques but might have never known them in the first place if not for Bob. How much of that art is mine vs Bob’s?

    Not saying AI is entirely equivalent to these scenarios or that anything should change based on the answers to the questions. They are mostly philosophical and interesting to consider IMO.

    I wish we had UBI so that this whole topic wasn’t so existential for people who depend on selling art to survive (which was difficult even before generative AI was a thing).






  • Regardless of what they are asking, you should have that conversation for your own sake, not just theirs. Though I’d also argue that if you are going to get married, you should want to do it for their sake, too. And if you resent them for not speaking their mind, don’t marry them.


  • Yeah no worries and agreed. I hate seeing commercial sites using worse password sanitization practices than I used for my first development website that wasn’t even really intended for anyone else to log in to and any max length suggests the password is either stored or processed in plaintext.

    IMO it should even be hashed on the client side before being sent so that it doesn’t show up as plaintext in any http requests or logs. Then salted and hashed again server side before being stored (or checked for login).


  • Correct, hence the sentence after the one you quoted :)

    If any service can recover your password and send it back to you rather than just resetting it for you to set a new one, don’t rely on that service for anything you want to keep secure. And certainly don’t reuse a password there, though you shouldn’t be reusing passwords anyways because who knows what they are and aren’t storing, even if they don’t offer password recovery.