27,676 reputation
970137
bio website ayrx.me
location Singapore
age 20
visits member for 3 years, 1 month
seen 1 hour ago

This is not the profile you are looking for.


Apr
15
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
@A.L Administrative overhead.
Mar
22
comment Why were CBC_SHA256 ciphersuites like TLS_RSA_WITH_AES_128_CBC_SHA256 defined?
It's the same reason why AES-256 exists. People assume that bigger is better.
Feb
28
comment Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?
@erotavlas Generally no.
Feb
21
comment Sanity check security scheme, is it secure? Is there cruft?
This problem has already been solved. See: npmjs.com/package/fernet
Feb
19
comment Can Google's administrators be trusted with Google Authenticator?
No. security.stackexchange.com/questions/35157/…
Feb
2
comment Does “Magic Numbers” weaken encryption?
@SilverlightFox Yes, my bad. :)
Jan
16
comment Which security measures does PyPI and similar third-party software repositories take?
@RоryMcCune Well, yeah. Computers are broken. Nothing new there.
Jan
16
comment Which security measures does PyPI and similar third-party software repositories take?
@moose There isn't. It's either audit your dependencies or place your trust on the developers.
Jan
3
comment The Pirate Bay - Secret Message?
I find it more plausible that HYDRA in this case is a Marvel reference.
Dec
21
comment Is e-mailing personal information significantly riskier than transmitting the same information another way?
hat me please! :)
Dec
18
comment Is Linux's 'W' command a security breach?
@cpast Both comments can be combined into a single pretty good (and correct) answer. :)
Dec
18
comment Is Linux's 'W' command a security breach?
@cpast That comment should be an answer.
Dec
15
comment HMAC-SHA256 Transaction signing
I'm not sure what this is about. TOTP is simply HMAC applied over the current Unix ntimestamp and truncated to 8 digits. Sure, you can derive the HMAC key from the transaction details somehow but that isn't "signing". You need to describe in more detail what you have in mind.
Dec
13
comment Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better?
@DavidHoelzer " but the overall overhead at the server end is quite substantial." Commonly repeated myth but completely untrue. See: istlsfastyet.com
Dec
13
comment Necessary components for PGP
If we want to go as generic as possible, I'd say symmetric and asymmetric encryption.
Dec
8
comment Timing attack against HMAC in authenticated encryption?
Excellent! I thought this was a Bear answer at first. :)
Oct
13
comment One-Time-Passwords resist against bruteforce attacks? Immune Alternative?
Your second point is false. There are algorithms that are information theoretic secure which means they remain secure even in the face of attackers with unlimited computing power.
Oct
11
comment Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
@AbeMiessler security.stackexchange.com/a/31846/10211 Scroll to the section on Salt Generation.
Sep
18
comment Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?
@nima I have no idea on that. I'm lucky enough to never have to concern myself about FIPS.
Sep
17
comment Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?
@nima cryptography.io/en/latest/installation/…