487 reputation
14
bio website
location
age
visits member for 1 year, 9 months
seen Aug 2 at 21:16

Jun
29
comment Klein and PTW wep attack
If the negative numbers are not expected, are you sure you aren't using signed where you should be using unsigned?
Dec
13
comment using asymmetric encryption to encrypt private key
@Arun: The "private key" up there refers to the symmetric key.
Dec
13
comment Site preventing user from closing tab/closing browser
@Rook: Please provide the bugzilla link if public.
Dec
13
comment Site preventing user from closing tab/closing browser
@blade19899: Ah, ok, I thought you opened a report in the bug reporting tool for the underlying issue. Nevermind then and thanks for reporting!
Dec
13
comment Site preventing user from closing tab/closing browser
@blade19899: Could you please post the link to the bug report(s) if they are public?
Dec
13
comment What web browsers support OCSP stapling? Are the privacy and performance features the same?
Firefox 26 now includes OCSP stapling support as per an announcement on mozilla.dev.security.policy.
Dec
12
comment Who tells that TrueCrypt is secure?
It should be noted that said French government group is also the one that certified that their own CA is secure and following best practices. The CA that has countless Sub-CAs which have mississued certs for MitM purposes, domains with typos, and example domains...
Dec
8
comment Why not hashing and salting passwords?
If my experience taught me anything, it is to not question why people would do stupid things - and never to assume that "noone can be that stupid" to do something really dumb.
Jan
28
comment How to correctly implement AES in a backup application
This is good advice. Also, it is important to use a secure mode of operation, i.e. not ECB. You then provide an IV for each file, not each block - it is an initialization vector. The IV for the next block is derived from the previous block (depending on the cipher mode). For turning a password into a key, you will probably want to use a PBKDF. You also may want to use that key to encrypt a master key, encrypt individual (e.g. file keys) with that master key, and store the encrypted individual keys.
Jan
2
comment What is this authentication method/approach called?
The entire approach is useless pseudo-security even if you require a weak token first. It is meant to allow users to detect phishing sites, and it cannot do that. The phishing site can always just relay the information it got, and relay back to the user the correct "knowledge". Sure, it requires a bit more effort from the phisher, but if you use indexed TANs or similar, they need to do this anyways.
Jan
2
comment GPU powered Password cracking machine - buy metal or cloud?
@this.josh I think the cost of unavailability in a password cracker is pretty limited, and unavailability on Amazon is probably lower than on a self-constructed machine.