Reputation
2,722
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
12 22
Newest
 Excavator
Impact
~148k people reached

Aug
12
awarded  Excavator
Aug
12
revised How can I best manage root passwords for many servers?
spelling
Aug
11
comment Do password managers leak information with swap memory?
Good operating systems encrypt their swap. Hell, even Windows can do it nowadays... To be honest, anything less than full disk encryption in 2015 is incredibly naive.
Jun
29
comment Why is there a “des-ede3-cbc” in my rsa private key?
With current known attacks, 3DES is still good with petabytes of data encrypted with the same key... I really wonder where that 512Kb figure comes from...
Jun
29
answered Why is there a “des-ede3-cbc” in my rsa private key?
May
28
reviewed Edit Things to do to ensure that data is secured on my virtual server
May
28
revised Things to do to ensure that data is secured on my virtual server
Improved question
May
25
reviewed Approve Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?
May
16
revised Decrypting SHA-256 with known plain text
added 28 characters in body
May
16
comment Decrypting SHA-256 with known plain text
Yes it does, however if %s is truly random and long enough they keyspace is still too large for it to be practical.
May
13
comment Which systems in a network are able to spoof a TCP handshake?
The question is badly worded... Is it a matter of just sending a SYN packet or does the attacker need to complete the three-ways handshake... The answers will be very different...
May
13
comment Is Schneier's “Applied Cryptography” current?
Thomas Ptacek had a blog entry in 2013 going in depth on the subject, way more than any answer here, highly recommended : sockpuppet.org/blog/2013/07/22/applied-practical-cryptography
May
13
comment HSM maintenance
My guess is swapping of a fan or a PSU, but yes, this question need to be reworded completely, and one thing is sure, whatever you do, the certification is not in danger...
May
11
reviewed Approve What is preventing us from sniffing the mobile phone communication?
May
11
comment HSM maintenance
I do believe this is on topic. The question here is not if the HSM will lose its certification, certification is done by a lab on behalf of the manufacturer. The question is whether your manipulations will trigger the anti tamper mechanisms or not. This question is best answered by the manufacturer, but the anti-tampering counter measures are to prevent you to access the keys. As long as you don't interfere with the shielding of the cryptographic module, and don't leave the equipment without electricity for too long, you should be fine.
May
9
reviewed Approve In the context of security engineering, is trust an equivalence relation?
May
9
reviewed Approve Does OpenPGP encryption mean that not even I can see my data?
May
8
reviewed Reject Router Ports open
May
8
reviewed Approve What to look for in a PHP file on my server to decide whether it is rogue or not?
May
8
answered Is there any possibility that a trusted CA can perform a man in middle attack?