Reputation
1,179
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
7 17
Impact
~58k people reached

  • 0 posts edited
  • 1 helpful flag
  • 47 votes cast
Oct
7
awarded  Enlightened
Oct
7
awarded  Nice Answer
Aug
24
awarded  Autobiographer
Aug
5
comment Slow client key exchange in TLS?
Please provide more information. It looks like OpenSSL. What version is it, can you reproduce that behavior with openssl s_client ? Do you have a public URL we can try ?
Aug
4
comment How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
I agree with @Casebash : if you have the password, access the data using CryptUnprotectData in a custom data extraction tool if needed. It is nice to have DPAPI reversed engineered, though.
Aug
4
answered Slow client key exchange in TLS?
Aug
2
comment Is the following authentication scheme secure?
You got -1'ed? That question is valid.
Aug
1
awarded  Nice Question
Jul
18
revised What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Used better style, starting the text with a clear, short answer to the question.
Jul
18
comment What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Indeed. Think of my questions as concerns you don't have with OpenID et al. I will edit my answer to use correct style. English is not my primary language, feel free to edit.
Jul
15
answered What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Jul
12
comment chosen plaintext attacks against MD5 and SHA1
No, MITM too (RFC2617 mentions it). An attacker can discard the digest value of the server and use its own.
Jul
11
revised chosen plaintext attacks against MD5 and SHA1
Redundant words removed words ;)
Jul
11
answered chosen plaintext attacks against MD5 and SHA1
Jul
8
answered When should I use Message layer encryption vs transport layer encryption
Jul
7
comment Does Windows really still use unsalted MD4 for password storage?
And doesn't Active Directoy need plain text password to encrypt the session key in a Kerberos ticket ? In which case it must store password in a reversible symetric scheme. The local password cache uses a salted hash, though, and you can disable it if you don't need offline logon (wich is rather rare, from my experience).
Jun
21
answered Programmer to Security Professional
Jun
16
comment When using AES and CBC, can the IV be a hash of the plaintext?
Makes sense. I edited my answer with an encrypted hash, but I made it up from my self-educated crypto background. I will read on encrypted indexes (I beleive cryptohash is something like RFC2104?)
Jun
16
awarded  Editor
Jun
16
revised When using AES and CBC, can the IV be a hash of the plaintext?
Provided an answer that is still fast and efficient, but with more security when a salted hash is not enough