692 reputation
418
bio website johngraybosch.com
location
age
visits member for 2 years, 1 month
seen 10 hours ago

I'm an Application Developer in Long Island, NY.


Apr
3
comment WebRTC P2P SSL - Where are the keys generated?
Ok, so assuming it provides trustworthy code, the server that unites the peers has no way of eavesdropping on the peers' communication? Also, I guess because the certificates are self-signed, the peers have no way of assuring each other of their identities, right?
Mar
26
comment Possible to Derive Private Key from Public Key Given Enough Computing Power?
Thanks for the detailed answer.
Mar
26
comment Possible to Derive Private Key from Public Key Given Enough Computing Power?
I think it would be answerable... It is similar to "How long would it take to brute force a SHA-1 password hash assuming the password was eight characters long?". Except substitute hash for RSA private key, eight characters for 4096 bits.
Oct
31
comment Is there a hash algorithm that can identify similar files or strings?
See also: stackoverflow.com/questions/12952729/…
Oct
31
comment Is there a hash algorithm that can identify similar files or strings?
Thanks Tom. Please see my update to my question and feel free to add your comments.
Oct
31
comment Is there a hash algorithm that can identify similar files or strings?
Yes that's what I was looking for. It's a curiosity. I was wondering if what you pointed me to exists. And I was wondering: do virus scanners use this? If not, why not?
Sep
14
comment How to detect the NSA MITM attack on SSL?
How did the NSA know the private key of the CA in the brazil case?
Sep
14
comment How to detect the NSA MITM attack on SSL?
Fixed the backbone router assumption.
Aug
7
comment Encrypting Fields in Database
@Saladin Actually in this scenario, the web application will only decrypt the key from the web.config on the pages or reports where the sensitive info needs to be retrieved. The idea is that ASP.NET has already authenticated the user through the auth cookie. This prevents an unauthenticated user from finding a SQL injection vulnerability on any arbitrary page and accessing the plain text info. This does not protect the info in the case of a stolen session.
Aug
2
comment Where can I get security breach alerts?
I like the national vulnerability database, which basically covers the same info as CVE, but you can get an RSS feed. nvd.nist.gov
Jul
9
comment Is it possible to prove which public key was used to encrypt a message?
I understand the difference. So to you my question might be, can you prove, mathematically that ciphertext C must have been encrypted by RSA public key K? Or if not prove, suggest with a high probability?
Jul
9
comment Is it possible to prove which public key was used to encrypt a message?
@Clockwork-Muse If Alice signed her message with her key before encrypting the message with Bob's key, then yes... But I'm not sure otherwise, hence the question. Please see my update.
Jun
19
comment How does does the “Sign out all other sessions” feature work in Gmail?
Hmm I guess the ASP.NET implementation is probably a question better asked on Stack Overflow.
Jun
19
comment How does does the “Sign out all other sessions” feature work in Gmail?
Why the downvote?
Jun
19
comment How does does the “Sign out all other sessions” feature work in Gmail?
Any idea how you'd accomplish this in ASP.NET?
Jun
19
comment Allowing user to access password protected website without disclosing the password
@schroeder you're right. But trust is a human problem. You can't solve everything with technology. That's why they have non-disclosure agreements, and the like.
Jun
19
comment Allowing user to access password protected website without disclosing the password
The employee and your friend should each have their own accounts, rather than using client's accounts...
Jun
17
comment Allow read-only access to server-side pages for security review?
Ahh, true. I guess the same is true when you have a server farm behind a web-facing proxy. The client can't tell the difference.
Jun
11
comment Is it possible to create a secure chat web application relying on HTML5 web sockets?
Is the security of the CA system any less reliable than ensuring that no one has tampered with a secure chat executable?
Jun
7
comment RSA vs PBKDF2 for password storage (theoretical)
Thanks for the detailed answer. I never realized that RSA produces a randomized cipher text, but now it makes sense why it would need to.