Reputation
1,299
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
10 18
Newest
 Enlightened
Impact
~73k people reached

  • 0 posts edited
  • 1 helpful flag
  • 51 votes cast
Apr
25
awarded  Commentator
Apr
25
comment TLS Renegotiation Indication Extension vulnerability
Right, the MITM can't decrypt, only inject. I've edited my answer for that point and take the -1, hoping that my edited answer is now correct, if not as well laid out as the others.
Apr
25
revised TLS Renegotiation Indication Extension vulnerability
Got the last part wrong
Apr
24
answered TLS Renegotiation Indication Extension vulnerability
Jan
26
awarded  Yearling
Oct
7
awarded  Enlightened
Oct
7
awarded  Nice Answer
Aug
24
awarded  Autobiographer
Aug
5
comment Slow client key exchange in TLS?
Please provide more information. It looks like OpenSSL. What version is it, can you reproduce that behavior with openssl s_client ? Do you have a public URL we can try ?
Aug
4
comment How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
I agree with @Casebash : if you have the password, access the data using CryptUnprotectData in a custom data extraction tool if needed. It is nice to have DPAPI reversed engineered, though.
Aug
4
answered Slow client key exchange in TLS?
Aug
2
comment Is the following authentication scheme secure?
You got -1'ed? That question is valid.
Aug
1
awarded  Nice Question
Jul
18
revised What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Used better style, starting the text with a clear, short answer to the question.
Jul
18
comment What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Indeed. Think of my questions as concerns you don't have with OpenID et al. I will edit my answer to use correct style. English is not my primary language, feel free to edit.
Jul
15
answered What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Jul
12
comment chosen plaintext attacks against MD5 and SHA1
No, MITM too (RFC2617 mentions it). An attacker can discard the digest value of the server and use its own.
Jul
11
revised chosen plaintext attacks against MD5 and SHA1
Redundant words removed words ;)
Jul
11
answered chosen plaintext attacks against MD5 and SHA1
Jul
8
answered When should I use Message layer encryption vs transport layer encryption