1,034 reputation
11125
bio website
location Singapore
age 23
visits member for 3 years, 7 months
seen 17 hours ago

Dec
12
comment Is a rand from /dev/urandom secure for a login key?
@NickJohnson, You are confusing the probability to win with the expected value. The expectation will be 4.5e-145, which is the average over many runs. But each run could well end up somewhere else, in this case: 0 * consequence or 1 * consequence. Some random people getting struck by lightning from a clear sky is less than insignificant compared to End-Of-Universe.
Dec
12
comment Is a rand from /dev/urandom secure for a login key?
@Thomas, Why does Schneier schneier.com/blog/archives/2013/10/insecurities_in.html contradict with your answer?
Dec
12
comment Is a rand from /dev/urandom secure for a login key?
So who is right, This page or schneier.com/blog/archives/2013/10/insecurities_in.html ?
Dec
12
comment Is a rand from /dev/urandom secure for a login key?
@NickJohnson, That depends on the consequence of a non-unique clash. If the consequence is End-Of-Universe, then yes it makes sense to check for uniqueness.
Dec
12
comment Is it possible for an attacker to change my sent emails content before arrival?
Actually the attacker can simply go to http:// www.my-domain.com/changepass?uid=username&secretkey=some-hardly-encoded-secure-k‌​ey and change the user's password
Dec
12
comment If I send an email over SSL, will it always be transmitted over SSL?
What if you use SSL to send directly to a SMTP server which you know supports SSL (e.g. Gmail)? Then wouldn't there be no more hopping?
Dec
12
comment Is sending password to user email secure?
So what's stopping the link in the email from being hijacked by a middle-man who uses the link to reset the user's password?
Dec
12
comment PUT vs. POST for password update
@Jack, Well you stated "Over https in the clear" sounds paradoxical, so I stated that it isn't.
Dec
11
comment PUT vs. POST for password update
So you are saying that the safest method of HTTP transport is via POST among all the possible methods? What about PATCH ?
Dec
11
comment PUT vs. POST for password update
@Jack, Depends on the location of the man-in-the-middle he can mitm certain requests/responses send over https in the clear.
Dec
10
comment Password strength and banks 4 pin code?
@AriTrachtenberg, The bank isn't protecting you but protecting themselves. They need to return you the money back, so it's their money they're saving
Dec
7
comment What techniques do advanced firewalls use to protect againt DoS/DDoS?
Why will an attacker spoof its IP address using a bogon IP? Surely an attacker would use an IP address that is already allocated, no?
Dec
7
comment What techniques do advanced firewalls use to protect againt DoS/DDoS?
Counter-attack.... but how do we attack someone we can't identify with certainty?
Dec
7
comment What techniques do advanced firewalls use to protect againt DoS/DDoS?
Related: serverfault.com/q/531941/87017
Dec
2
comment How to securely hash passwords?
@trysis, Wait for 2015 Q2. The results should be out by then.
Dec
2
comment Password Hashing add salt + pepper or is salt enough?
@frankodwyer, You could even have both. Constant in the code on the webserver plus another constant in a "config" entity on another server.
Dec
2
comment https security - should password be hashed server-side or client-side?
Also see security.stackexchange.com/q/23006/2379
Nov
21
comment How to trace a (mobile) phone?
The question is why should these tools not be available to the public?
Nov
21
comment How to trace a (mobile) phone?
This doesn't seem possible. Can you elaborate on how the "behavior tracking" works?
Nov
21
comment Where can I learn cryptography/cryptanalysis the hard way, without going to school ? Any good book?
Site down...........