264 reputation
1310
bio website
location
age
visits member for 1 year, 5 months
seen May 12 at 1:18

May
12
comment How secure is the SRP that Blizzard uses to protect passwords?
What CodesInChaos probably meant is that modexp with constant g and N can be fasten up, opposite to hash scrutinizing functions.
Nov
29
comment Does a CA need to have the same type of key as the certificates it is signing? RSA / Elliptic Curve (EC/ECDH/ECDSA)
google has EC certificate signed with sha1-rsa serverfault.com/a/558322/201011
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos at least client's parameters are transmitted unprotected. Can the mitmer tell the server the clent doesn't support DHE?
Nov
26
comment What algorithms are best be cracked by GPU?
"Salted passwords are another 'obstacle' to GPU cracking." - salt make any bruteforce harder, changing the complexity from O(log n) to O(n) regardless if it's CPU, GPU or IdkPU.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
"Those rough costs suggest that the Twisted Edwards precomputation should be 3.6x faster, which is promising!" - not that much, but it's worth mentioning on SRP page.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
How much ressources do you need and how much does it speed up?
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos interesting, can you explain it?
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos Are SSL connection parameters part of certificate?
Nov
26
comment What is a pen tester?
A person who tests pens. If they write properly, you know.
Nov
26
comment Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
Can't their admins be charged for open SMTP servers?
Nov
26
comment Why can SSL certificates not be free of charge?
With SRP, you won't need any certificates after account creation.
Nov
26
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos is there a difference if the base is fixed?
Nov
26
comment How common is Perfect Forward Secrecy in HTTPS clients?
@CodesInChaos don't you think the connection will be vulnerable to MITM? SSL parameres exchange is done in plaintext.
May
26
comment Why don't major browsers currently support TLS above version 1.0?
bugzilla.mozilla.org/show_bug.cgi?id=480514#c86 2013-05-24 21:14:19 "Seems abandoned. Sad really." lol
May
24
comment Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack?
How about other managers?
May
22
comment How secure is the SRP that Blizzard uses to protect passwords?
@CodesInChaos that doesn't really matter in case of SRP - if you'll find discrete logarithm and find the password hash, you don't need the password anymore, you can use the hash to log in. If you can't find it, you have to calculate modpow() for each password and verifier which is slow enough.
Mar
28
comment Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack?
No wai under Windows?
Mar
28
comment Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack?
+1 to the question. Is there a way to connect to an AP with given SSID and MAC? E.g. if you have 2 APs with same SSID and want to be connected to one of them regardless to signal strength.
Mar
28
comment DNS Spoofing vs DNS Cache Poisoning
So is DNS spoofing a result and DNS poisoning - a way to the result?
Mar
27
comment Has the WPS brute-force cracking issue been fixed?
Thank for describing of WPS vulnerability.. oh wait, I already knew it! For some reasons, WPS bruteforce with reaver doesn't work for that people. Wonder why.