meta user
network profile
| bio | website | paralint.com |
|---|---|---|
| location | Montreal, Canada | |
| age | ||
| visits | member for | 2 years, 4 months |
| seen | Apr 13 at 15:31 | |
| stats | profile views | 49 |
I like smart people who get things done. I do my best everyday to be one of them.
I code mostly in C++, Python, Java and... whatever comes my way. I also like to understand a problem down to its roots, a process also known as debugging.
|
Oct 7 |
awarded | Nice Answer |
|
Aug 24 |
awarded | Autobiographer |
|
Aug 5 |
comment |
Slow client key exchange in TLS? Please provide more information. It looks like OpenSSL. What version is it, can you reproduce that behavior with openssl s_client ? Do you have a public URL we can try ? |
|
Aug 4 |
comment |
How can I mitigate the threat that DPAPick poses to my DPAPI protected data? I agree with @Casebash : if you have the password, access the data using CryptUnprotectData in a custom data extraction tool if needed. It is nice to have DPAPI reversed engineered, though. |
|
Aug 4 |
answered | Slow client key exchange in TLS? |
|
Aug 2 |
comment |
Is the following authentication scheme secure? You got -1'ed? That question is valid. |
|
Aug 1 |
awarded | Nice Question |
|
Jul 18 |
revised |
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook? Used better style, starting the text with a clear, short answer to the question. |
|
Jul 18 |
comment |
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook? Indeed. Think of my questions as concerns you don't have with OpenID et al. I will edit my answer to use correct style. English is not my primary language, feel free to edit. |
|
Jul 15 |
answered | What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook? |
|
Jul 12 |
comment |
chosen plaintext attacks against MD5 and SHA1 No, MITM too (RFC2617 mentions it). An attacker can discard the digest value of the server and use its own. |
|
Jul 11 |
revised |
chosen plaintext attacks against MD5 and SHA1 Redundant words removed words ;) |
|
Jul 11 |
answered | chosen plaintext attacks against MD5 and SHA1 |
|
Jul 8 |
answered | When should I use Message layer encryption vs transport layer encryption |
|
Jul 7 |
comment |
Does Windows really still use unsalted MD4 for password storage? And doesn't Active Directoy need plain text password to encrypt the session key in a Kerberos ticket ? In which case it must store password in a reversible symetric scheme. The local password cache uses a salted hash, though, and you can disable it if you don't need offline logon (wich is rather rare, from my experience). |
|
Jun 21 |
answered | Programmer to Security Professional |
|
Jun 16 |
comment |
When using AES and CBC, can the IV be a hash of the plaintext? Makes sense. I edited my answer with an encrypted hash, but I made it up from my self-educated crypto background. I will read on encrypted indexes (I beleive cryptohash is something like RFC2104?) |
|
Jun 16 |
awarded | Editor |
|
Jun 16 |
revised |
When using AES and CBC, can the IV be a hash of the plaintext? Provided an answer that is still fast and efficient, but with more security when a salted hash is not enough |
|
Jun 16 |
comment |
When using AES and CBC, can the IV be a hash of the plaintext? You are right about low entropy, dictionnary and rainbow tables are real risk. But is there efficient way to search for a random IV cipher text from a plaintext, when each IV is different (as stated in the question) ? |
