Reputation
32,724
Next tag badge:
592/400 score
77/80 answers
Badges
2 36 84
Newest
 Yearling
Impact
~1.7m people reached

Nov
25
answered Are photographs of fingerprints a security risk?
Nov
25
reviewed Close Weird characters from contact page
Nov
24
reviewed Close TLS Authentication/OpenVPN/MITM Attacks on Public Wifi
Nov
24
reviewed Close How to identify which storage USB device is BadUSB-free at store?
Nov
24
reviewed Close Using salt or secret for Hmac
Nov
24
reviewed Close How do I view a list of known unpatched windows xp arbitrary code execution vulnerabilities?
Nov
24
comment Can a botnet be used to effectively break encryption keys?
@k1DBLITZ - when the times to crack are several orders of magnitude past the heat death of the universe, it doesn't practically matter. Every additional bit DOUBLES the time to crack, assuming there aren't flaws in the algorithm.
Nov
24
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@nowen - fair enough.
Nov
21
answered Encrypted retrievable password
Nov
21
comment Encrypted retrievable password
@MatthewPeters - fair enough, happens to us all.
Nov
21
comment Encrypted retrievable password
@BustedSanta, does the decrypted password need to be available offline (ie, when the user isn't logged in)?
Nov
21
answered Can a botnet be used to effectively break encryption keys?
Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - oohhh, that's YOUR product that you handily didn't disclose your affiliation with in the comment. Please tell me you are at least using a randomized GUI pin entry that doesn't link to key press events so that it is protected against basic loggers. (Which would be the reason I put the (almost) in the above comment.) Otherwise, the feature is completely worthless (and actually a hindrance to users).
Nov
21
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - which would still be entered on a compromised device and thus provide 0 to almost 0 additional security. It only prevents a non-persistent remote exploit of the device, which is a very, very small use case of protection. More thoroughly, it only helps you when there isn't key logging on the device, in which case the password for the site wouldn't be compromised and the 2FA token compromise wouldn't matter. There is literally almost no situation (if any) that WiKID's password on the token helps anything.
Nov
21
answered Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
Nov
20
reviewed Close Protected excel sheet is unprotected without permission in google spreadsheet
Nov
20
reviewed Close Should one worry about using an outdated version of Firefox?
Nov
20
reviewed Close Advice on if I should talk at my local user group about NIST, InfoSec etc
Nov
20
reviewed Close bscrypt,scrypt v/s iterative SHA-x
Nov
19
revised storage of client credential on OAuth2 server
added 404 characters in body