Eugene Beresovksy

125 reputation

bio	website
	location
	age
visits	member for	7 months
	seen	Dec 25 '12 at 23:20
stats	profile views	4

	125 reputation	bio	website		visits	member for	7 months
5 badges		location			seen	Dec 25 '12 at 23:20

summary answers questions tags badges favorites bounties reputation activity

23 Actions

suggestions reviews revisions comments badges posts accepts all

Oct 24	awarded	Commentator
Oct 24	comment	How does “check.torproject.org.” know if you're using TOR? @Aki What about NAT'ed addresses? Or can TOR exit nodes not be NAT'ed?
Oct 17	comment	Do Client Nonces enhance the security of HTTP Digest Auth? Re: `mutual auth` I can follow the RFC: `the "response-auth" directive supports mutual authentication -- the server proves that it knows the user's secret, and with qop=auth-int also provides limited integrity protection of the response`, according to which mutual auth is provided by the password, not the cnonce.
Oct 17	revised	Do Client Nonces enhance the security of HTTP Digest Auth? added 274 characters in body
Oct 16	awarded	Scholar
Oct 16	accepted	Do Client Nonces enhance the security of HTTP Digest Auth?
Oct 16	comment	Do Client Nonces enhance the security of HTTP Digest Auth? @DavidWachtfogel The attack you describe makes the advantage of a cNonce clear. Re: `could be used to attack the same username on many users`, I updated my question with details on `Digest Auth` that make it clear when and how that would work. All `admin` users, to stay in your example, who use Opera would be protected against that form of reuse,
Oct 16	comment	Do Client Nonces enhance the security of HTTP Digest Auth? +1 Thanks for reminding me of that important part of Pornin's answer.
Oct 16	revised	Do Client Nonces enhance the security of HTTP Digest Auth? added 1261 characters in body
Oct 16	comment	Do Client Nonces enhance the security of HTTP Digest Auth? Thanks for the `realm` comment. Just updated the question. In terms of the cnonce: So what you are saying is that the client could be `stateless` and would still be able to check if the cnonce originated from it? Otherwise, as the cnonce is sent as plaintext, it is not a shared secret or anything with even a minimum hurdle for an attacker to figure out.
Oct 16	revised	Do Client Nonces enhance the security of HTTP Digest Auth? added 51 characters in body
Oct 16	comment	Do Client Nonces enhance the security of HTTP Digest Auth? Hmm... still mulling over your mutual authentication comment. I don't see how the random cnonce helps providing authentication of the client to the server and a bit of searching still leaves me clueless. Would you care to elaborate or do you have a helpful link, perhaps?
Oct 16	comment	Do Client Nonces enhance the security of HTTP Digest Auth? Re: realm - Sure, it's a value chosen by whoever implements / administers the service, and as such not necessarily unique, but in my case, I have control over this, and I chose something that is so unlikely to be used by any other server. So I don't worry about a rainbow table for that realm flying around.
Oct 16	awarded	Student
Oct 16	revised	Do Client Nonces enhance the security of HTTP Digest Auth? edited title
Oct 16	asked	Do Client Nonces enhance the security of HTTP Digest Auth?
Oct 12	awarded	Editor
Oct 12	revised	How does SSL work? SSL is not TCP only (see. http://en.wikipedia.org/wiki/Secure_Sockets_Layer#Applications)
Oct 12	suggested	suggested edit on How does SSL work?
Oct 10	comment	CRIME - How to beat the BEAST successor? @FlorianMargaine In case you didn't know, ThomasPornin is a paid bait ;) - a tasty one, admittedly.