2,662 reputation
1221
bio website
location Paris, France
age
visits member for 4 years, 1 month
seen 2 days ago

Security consultant, specializing in application security.


May
16
answered What kind of hash is this?
May
16
revised Decrypting SHA-256 with known plain text
added 28 characters in body
May
16
comment Decrypting SHA-256 with known plain text
Yes it does, however if %s is truly random and long enough they keyspace is still too large for it to be practical.
May
13
comment Which systems in a network are able to spoof a TCP handshake?
The question is badly worded... Is it a matter of just sending a SYN packet or does the attacker need to complete the three-ways handshake... The answers will be very different...
May
13
comment Is Schneier's “Applied Cryptography” current?
Thomas Ptacek had a blog entry in 2013 going in depth on the subject, way more than any answer here, highly recommended : sockpuppet.org/blog/2013/07/22/applied-practical-cryptography
May
13
comment HSM maintenance
My guess is swapping of a fan or a PSU, but yes, this question need to be reworded completely, and one thing is sure, whatever you do, the certification is not in danger...
May
11
reviewed Approve What is preventing us from sniffing the mobile phone communication?
May
11
comment HSM maintenance
I do believe this is on topic. The question here is not if the HSM will lose its certification, certification is done by a lab on behalf of the manufacturer. The question is whether your manipulations will trigger the anti tamper mechanisms or not. This question is best answered by the manufacturer, but the anti-tampering counter measures are to prevent you to access the keys. As long as you don't interfere with the shielding of the cryptographic module, and don't leave the equipment without electricity for too long, you should be fine.
May
9
reviewed Approve In the context of security engineering, is trust an equivalence relation?
May
9
reviewed Approve Does OpenPGP encryption mean that not even I can see my data?
May
8
reviewed Reject Router Ports open
May
8
reviewed Approve What to look for in a PHP file on my server to decide whether it is rogue or not?
May
8
answered Is there any possibility that a trusted CA can perform a man in middle attack?
May
8
revised What to look for in a PHP file on my server to decide whether it is rogue or not?
spelling
May
7
reviewed Approve Bring your own phone to a (new) job: Consequences?
May
7
answered Can a website detect which method you are using to connect (LL2P, SSTP and PPTP)
Apr
17
awarded  Nice Answer
Apr
16
comment IPsec on multicast
@raz IPsec was very rarely even on the table in the IoT projects I've been involved in. Not popular to say the least...
Apr
14
comment IP over HTTP GET only
Just a note : a site restricting traffic so much that only some whitelisted HTTP traffic is authorized shouldn't have external DNS enabled, all name resolutions shall be done at the HTTP proxy level, unless it was setup in a pretty incompetent manner, as DNS tunneling is a well known threat.
Mar
29
awarded  Yearling