264 reputation
1310
bio website
location
age
visits member for 1 year, 6 months
seen Aug 23 at 5:58

May
12
comment How secure is the SRP that Blizzard uses to protect passwords?
What CodesInChaos probably meant is that modexp with constant g and N can be fasten up, opposite to hash scrutinizing functions.
Feb
25
awarded  Famous Question
Feb
23
awarded  Yearling
Jan
27
awarded  Popular Question
Jan
1
awarded  Notable Question
Nov
29
comment Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
google has EC certificate signed with sha1-rsa serverfault.com/a/558322/201011
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos at least client's parameters are transmitted unprotected. Can the mitmer tell the server the clent doesn't support DHE?
Nov
26
revised Why do people say that PHP is inherently insecure?
added 3 characters in body
Nov
26
comment What algorithms are best be cracked by GPU?
"Salted passwords are another 'obstacle' to GPU cracking." - salt make any bruteforce harder, changing the complexity from O(log n) to O(n) regardless if it's CPU, GPU or IdkPU.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
"Those rough costs suggest that the Twisted Edwards precomputation should be 3.6x faster, which is promising!" - not that much, but it's worth mentioning on SRP page.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
How much ressources do you need and how much does it speed up?
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos interesting, can you explain it?
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos Are SSL connection parameters part of certificate?
Nov
26
revised Why do people say that PHP is inherently insecure?
added 137 characters in body
Nov
26
comment What is a pen tester?
A person who tests pens. If they write properly, you know.
Nov
26
comment Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
Can't their admins be charged for open SMTP servers?
Nov
26
comment Why can SSL certificates not be free of charge?
With SRP, you won't need any certificates after account creation.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos is there a difference if the base is fixed?
Nov
26
revised Why do people say that PHP is inherently insecure?
added 196 characters in body
Nov
26
answered Why do people say that PHP is inherently insecure?