David Wachtfogel

2,931 reputation

119

bio	website	goodenoughsecurity.blogspot.c…
	location	Jerusalem, Israel
	age	39
visits	member for	10 months
	seen	Mar 13 at 7:51
stats	profile views	48

Digital security professional and manager. Work on chip hardware security (smart cards, USB tokens, consumer electronics), DRM, proprietary cryptography and protocols, embedded software security, end-to-end system security and security policy.

IT security (especially password security) is a hobby.

	2,931 reputation	bio	website	goodenoughsecurity.blogspot.c…	visits	member for	10 months
119 badges		location	Jerusalem, Israel		seen	Mar 13 at 7:51

summary answers questions tags badges favorites bounties reputation activity

172 Actions

suggestions reviews revisions comments badges posts accepts all

Oct 18	answered	Can someone detect the URL an android app uses?
Oct 17	revised	Privacy implications of IDFA/IDFV? (iPhone/iOS) added 23 characters in body
Oct 17	revised	Privacy implications of IDFA/IDFV? (iPhone/iOS) typo fix
Oct 17	answered	Privacy implications of IDFA/IDFV? (iPhone/iOS)
Oct 16	comment	Do Client Nonces enhance the security of HTTP Digest Auth? Correct, but this would require the attacker to redo the exhaustive search for each password the attacker wants to crack. If it wasn't for the client nonce the attacker could do the exhaustive search operation once per username and build a hash table which could be used to attack the same username on many servers.
Oct 16	revised	Do Client Nonces enhance the security of HTTP Digest Auth? added 111 characters in body
Oct 16	answered	Do Client Nonces enhance the security of HTTP Digest Auth?
Oct 16	answered	A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
Oct 15	comment	Doing a dictionary attack on RSA if you have the public key? Take a look at Thomas Pornin's response at stackoverflow.com/a/7568183/1616145
Oct 15	comment	Base64 encode diffences in BCrypt implemenations Don't you mean "as long as $c2 is an 8-bit value"?
Oct 15	answered	Does anyone use XML Encryption?
Oct 14	comment	Known password length, brute force character in place? @OlegV.Volkov That quote is taken out of context. Their analysis was done on a customer application but is based on simulated real world applications. I know for a fact that this attack is possible in the real world because I've actually done it on a test system.
Oct 14	comment	Known password length, brute force character in place? @OlegV.Volkov please read rdist.root.org/2010/07/19/exploiting-remote-timing-attacks - this exact attack was done by them. The paper talks about 20 microseconds - not milliseconds.
Oct 13	comment	Known password length, brute force character in place? @OlegV.Volkov Besides Nate Lawson's work I linked to in my previous comment, there's also this paper, cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf, which states that time differences as small as 20 microseconds can be detected over the Internet.
Oct 13	answered	Is there any processor that could decrypt encrypted data and machine instructions?
Oct 13	comment	Known password length, brute force character in place? That's why I wrote you would need to try each multiple times - to cancel out the noise. This has been done succesfully by many reseachers - for example, please see rdist.root.org/2010/07/19/exploiting-remote-timing-attacks.
Oct 12	awarded	Nice Answer
Oct 12	revised	Known password length, brute force character in place? added 1 characters in body
Oct 12	reviewed	Reviewed OpenBSD, fbtab and X Window
Oct 12	revised	Known password length, brute force character in place? added 76 characters in body