3,116 reputation
221
bio website goodenoughsecurity.blogspot.c…
location Jerusalem, Israel
age 40
visits member for 1 year, 8 months
seen Mar 6 at 7:06

Digital security professional and manager. Work on chip hardware security (smart cards, USB tokens, consumer electronics), DRM, proprietary cryptography and protocols, embedded software security, end-to-end system security and security policy.

IT security (especially password security) is a hobby.


Oct
19
answered What is a DoS Attack and how does it differ from a DDoS attack?
Oct
18
revised Can someone detect the URL an android app uses?
deleted 9 characters in body
Oct
18
answered Can someone detect the URL an android app uses?
Oct
17
revised Privacy implications of IDFA/IDFV? (iPhone/iOS)
added 23 characters in body
Oct
17
revised Privacy implications of IDFA/IDFV? (iPhone/iOS)
typo fix
Oct
17
answered Privacy implications of IDFA/IDFV? (iPhone/iOS)
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Correct, but this would require the attacker to redo the exhaustive search for each password the attacker wants to crack. If it wasn't for the client nonce the attacker could do the exhaustive search operation once per username and build a hash table which could be used to attack the same username on many servers.
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 111 characters in body
Oct
16
answered Do Client Nonces enhance the security of HTTP Digest Auth?
Oct
16
answered A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
Oct
15
comment Doing a dictionary attack on RSA if you have the public key?
Take a look at Thomas Pornin's response at stackoverflow.com/a/7568183/1616145
Oct
15
comment Base64 encode diffences in BCrypt implemenations
Don't you mean "as long as $c2 is an 8-bit value"?
Oct
15
answered Does anyone use XML Encryption?
Oct
14
comment Known password length, brute force character in place?
@OlegV.Volkov That quote is taken out of context. Their analysis was done on a customer application but is based on simulated real world applications. I know for a fact that this attack is possible in the real world because I've actually done it on a test system.
Oct
14
comment Known password length, brute force character in place?
@OlegV.Volkov please read rdist.root.org/2010/07/19/exploiting-remote-timing-attacks - this exact attack was done by them. The paper talks about 20 microseconds - not milliseconds.
Oct
13
comment Known password length, brute force character in place?
@OlegV.Volkov Besides Nate Lawson's work I linked to in my previous comment, there's also this paper, cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf, which states that time differences as small as 20 microseconds can be detected over the Internet.
Oct
13
answered Is there any processor that could decrypt encrypted data and machine instructions?
Oct
13
comment Known password length, brute force character in place?
That's why I wrote you would need to try each multiple times - to cancel out the noise. This has been done succesfully by many reseachers - for example, please see rdist.root.org/2010/07/19/exploiting-remote-timing-attacks.
Oct
12
awarded  Nice Answer
Oct
12
revised Known password length, brute force character in place?
added 1 characters in body