902 reputation
614
bio website paralint.com
location Montreal, Canada
age
visits member for 3 years, 2 months
seen Apr 9 at 15:53

I like smart people who get things done. I do my best everyday to be one of them.

I code mostly in C++, Python, Java and... whatever comes my way. I also like to understand a problem down to its roots, a process also known as debugging.

LinkedIn and Careers profiles.


Apr
25
revised TLS Renegotiation Indication Extension vulnerability
Got the last part wrong
Apr
24
answered TLS Renegotiation Indication Extension vulnerability
Jan
26
awarded  Yearling
Oct
7
awarded  Enlightened
Oct
7
awarded  Nice Answer
Aug
24
awarded  Autobiographer
Aug
5
comment Slow client key exchange in TLS?
Please provide more information. It looks like OpenSSL. What version is it, can you reproduce that behavior with openssl s_client ? Do you have a public URL we can try ?
Aug
4
comment How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
I agree with @Casebash : if you have the password, access the data using CryptUnprotectData in a custom data extraction tool if needed. It is nice to have DPAPI reversed engineered, though.
Aug
4
answered Slow client key exchange in TLS?
Aug
2
comment Is the following authentication scheme secure?
You got -1'ed? That question is valid.
Aug
1
awarded  Nice Question
Jul
18
revised What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Used better style, starting the text with a clear, short answer to the question.
Jul
18
comment What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Indeed. Think of my questions as concerns you don't have with OpenID et al. I will edit my answer to use correct style. English is not my primary language, feel free to edit.
Jul
15
answered What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Jul
12
comment chosen plaintext attacks against MD5 and SHA1
No, MITM too (RFC2617 mentions it). An attacker can discard the digest value of the server and use its own.
Jul
11
revised chosen plaintext attacks against MD5 and SHA1
Redundant words removed words ;)
Jul
11
answered chosen plaintext attacks against MD5 and SHA1
Jul
8
answered When should I use Message layer encryption vs transport layer encryption
Jul
7
comment Does Windows really still use unsalted MD4 for password storage?
And doesn't Active Directoy need plain text password to encrypt the session key in a Kerberos ticket ? In which case it must store password in a reversible symetric scheme. The local password cache uses a salted hash, though, and you can disable it if you don't need offline logon (wich is rather rare, from my experience).
Jun
21
answered Programmer to Security Professional