3,311 reputation
524
bio website goodenoughsecurity.blogspot.c…
location Jerusalem, Israel
age 41
visits member for 2 years, 4 months
seen Mar 6 at 7:06

Digital security professional and manager. Work on chip hardware security (smart cards, USB tokens, consumer electronics), DRM, proprietary cryptography and protocols, embedded software security, end-to-end system security and security policy.

IT security (especially password security) is a hobby.


Oct
23
answered Client side password hashing
Oct
22
answered What is the potential impact of these SSL certificate validation vulnerabilities?
Oct
22
comment Can someone detect the URL an android app uses?
@CodesInChaos Good comment - made a small edit to clarify this point
Oct
22
revised Can someone detect the URL an android app uses?
Adding explanation that rooting helps if the certificate is hardcoded.
Oct
19
revised What is a DoS Attack and how does it differ from a DDoS attack?
added 2 characters in body
Oct
19
revised What is a DoS Attack and how does it differ from a DDoS attack?
added TL;DR
Oct
19
answered What is a DoS Attack and how does it differ from a DDoS attack?
Oct
18
revised Can someone detect the URL an android app uses?
deleted 9 characters in body
Oct
18
answered Can someone detect the URL an android app uses?
Oct
17
revised Privacy implications of IDFA/IDFV? (iPhone/iOS)
added 23 characters in body
Oct
17
revised Privacy implications of IDFA/IDFV? (iPhone/iOS)
typo fix
Oct
17
answered Privacy implications of IDFA/IDFV? (iPhone/iOS)
Oct
16
comment Do Client Nonces enhance the security of HTTP Digest Auth?
Correct, but this would require the attacker to redo the exhaustive search for each password the attacker wants to crack. If it wasn't for the client nonce the attacker could do the exhaustive search operation once per username and build a hash table which could be used to attack the same username on many servers.
Oct
16
revised Do Client Nonces enhance the security of HTTP Digest Auth?
added 111 characters in body
Oct
16
answered Do Client Nonces enhance the security of HTTP Digest Auth?
Oct
16
answered A String that if encrypted or decrypted with the same key gets an English word/statement in both cases
Oct
15
comment Doing a dictionary attack on RSA if you have the public key?
Take a look at Thomas Pornin's response at stackoverflow.com/a/7568183/1616145
Oct
15
comment Base64 encode diffences in BCrypt implemenations
Don't you mean "as long as $c2 is an 8-bit value"?
Oct
15
answered Does anyone use XML Encryption?
Oct
14
comment Known password length, brute force character in place?
@OlegV.Volkov That quote is taken out of context. Their analysis was done on a customer application but is based on simulated real world applications. I know for a fact that this attack is possible in the real world because I've actually done it on a test system.