278 reputation
1312
bio website
location
age
visits member for 1 year, 8 months
seen Oct 5 at 8:57

Oct
5
comment Shellshock exploit on Linux Routers/Modems?
@Mark sort of maybe? It uses ash or other shell, so it would be vulnerable only if ash or this other shell would be vulnerable.
Sep
28
comment Shellshock exploit on Linux Routers/Modems?
@Mark So busybox is not a shell but a wrapper for ash, am I right?
Sep
28
comment Is Django vulnerable to shellshock?
How does it affect WSGI?
Sep
28
comment Shellshock exploit on Linux Routers/Modems?
"Most Linux-based routers are running an OpenWRT/DD-WRT derivative." - lolwut? And busybox is not a shell.
Sep
25
comment Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?
@sep332 your comment is worth converting to an answer or an answer to a separate question.
Sep
25
comment How to exploit bash shellshock expoit?
It can have only one answer, what do you want more?
May
12
comment How secure is the SRP that Blizzard uses to protect passwords?
What CodesInChaos probably meant is that modexp with constant g and N can be fasten up, opposite to hash scrutinizing functions.
Nov
29
comment Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
google has EC certificate signed with sha1-rsa serverfault.com/a/558322/201011
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos at least client's parameters are transmitted unprotected. Can the mitmer tell the server the clent doesn't support DHE?
Nov
26
comment What algorithms are best be cracked by GPU?
"Salted passwords are another 'obstacle' to GPU cracking." - salt make any bruteforce harder, changing the complexity from O(log n) to O(n) regardless if it's CPU, GPU or IdkPU.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
"Those rough costs suggest that the Twisted Edwards precomputation should be 3.6x faster, which is promising!" - not that much, but it's worth mentioning on SRP page.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
How much ressources do you need and how much does it speed up?
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos interesting, can you explain it?
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos Are SSL connection parameters part of certificate?
Nov
26
comment What is a pen tester?
A person who tests pens. If they write properly, you know.
Nov
26
comment Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
Can't their admins be charged for open SMTP servers?
Nov
26
comment Why can SSL certificates not be free of charge?
With SRP, you won't need any certificates after account creation.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos is there a difference if the base is fixed?
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos don't you think the connection will be vulnerable to MITM? SSL parameres exchange is done in plaintext.
May
26
comment Why don't major browsers currently support TLS above version 1.0?
bugzilla.mozilla.org/show_bug.cgi?id=480514#c86 2013-05-24 21:14:19 "Seems abandoned. Sad really." lol