302 reputation
111
bio website owlfolio.org
location Pittsburgh, PA
age 37
visits member for 4 years, 8 months
seen Jul 30 at 18:49

Hello, my name is Zachary Weinberg. I go by “Zack,” except on paper. Pleased to meet you.

I’m about thirty-five years old, and I grew up in the suburbs of Los Angeles, California. I do computer security research at CMU.

I AM NOT LOOKING FOR A JOB. DO NOT CONTACT ME WITH ANY SORT OF JOB OFFER. I regret the bluntness and ALLCAPSNESS of the previous statement, but this account has become a principal source of the recruitment spam I get, and anything short of a flat-out upfront NO is completely ineffective. *waves old man cane at clouds*


Jul
7
awarded  Commentator
Jul
7
comment Is there such a thing as public key steganography
Unless the encryption algorithm has been specifically designed to make every bit of its output indistinguishable from random noise, it probably has a cleartext "envelope" -- containing things like the message length, the algorithms involved, and the IV -- which are easily distinguishable from randomness, and may be near-constant across messages. If you have a large collection of files that you suspect of containing steganographic messages, detecting the same envelope in many of them would be the proverbial smoking gun.
Jun
10
comment How do I report a security vulnerability about a trusted certificate authority?
This is the answer I was about to post
May
28
awarded  Popular Question
May
11
awarded  Critic
May
11
comment Prevention measures against laptop seizure at US borders
It is nonetheless subject to any number of operational security problems which render it extremely difficult to execute safely by hand.
May
11
comment Prevention measures against laptop seizure at US borders
This is theoretically sound, but in the absence of off-the-shelf software to execute it with attention to all the details, is likely to get people in even more trouble when, not if, it fails.
Mar
18
comment Does this image contain secret data?
Also, they appear to be in an ascending sequence. Does that continue throughout? If you take the numeric difference between pairs of numbers, does that reveal a pattern?
Mar
18
comment Does this image contain secret data?
Those are clearly 128-bit hexadecimal numbers. Concatenate them, convert them to binary, and run the result through a standard compression algorithm (e.g. gzip). How much smaller is the result, relative to the uncompressed version? (It's important that you convert to binary else you will only measure gzip's ability to compensate for hexadecimal coding overhead.)
Nov
30
awarded  Scholar
Nov
30
comment Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?
This is the pedantic, standard-citing answer I was looking for. Thank you.
Nov
30
accepted Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?
Nov
26
awarded  Student
Nov
26
revised Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?
clarify scenario under discussion
Nov
26
asked Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?
Aug
4
awarded  Editor
Aug
4
revised How does a country block/censor an encrypted website (HTTPS)?
deleted 31 characters in body
Aug
4
awarded  Nice Answer
Aug
4
awarded  Yearling
Aug
4
awarded  Teacher