7,116 reputation
11835
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 7 months
seen 15 hours ago

18h
comment Will gmail close my well intentioned botnet account?
Does that mean that every one of those 1000 computers knows the password to the gmail account?
2d
awarded  Good Answer
Mar
23
comment Is it illegal to access a public file that contain private information?
I hope you don't live in the US.
Mar
23
revised Why can't I use the same key for encryption and MAC?
added 20 characters in body
Mar
23
comment I see two different sets of certificates for Google websites when I am at work and when I am at home
"Because sharing certificates degrades security [...] prohibits customers from using a certificate on more than one physical server or device at a time, unless the customer has purchased additional server licenses" We only want your best ;)
Mar
23
comment OpenSSL: Allow CBC ciphers for TLS but prevent for SSL3
Can you afford simply disabling SSL3?
Mar
23
reviewed Approve Can a Trojan hide itself, so its activity doesn't appear in task manager process?
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
Unlinking yourself from the module list isn't too hard. Alternatively you can write your own dll loader that doesn't register your code in any such lists. I've seen both of these techniques employed by game hacks to hide from anti-cheat tools.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
@Polynomial You don't need any hooks if you don't have a process to hide.
Mar
23
comment Can a Trojan hide itself, so its activity doesn't appear in task manager process?
A popular approach is injecting a dll into a common process (e.g. explorer). No need to hide a process if you don't create one.
Mar
19
comment Why does GnuPG shrink my file after elgamal encryption?
With properly implemented crypto using strong primitives there are not attacks that compression can prevent. But there are attacks it can cause (famously CRIME against TLS). But PGP and its derivatives were designed before that point of view became prevalent.
Mar
18
comment How can Alice and Bob prove that they share a file?
Search for proof-of-knowledge, proof-of-possession, proof-of-retrievability for related literature.
Mar
18
comment How can Alice and Bob prove that they share a file?
"although they can secretly talk to each other (note that even if Alice or Bob have f, they can't show f to each other)" doesn't really make sense. If they can communicate and choose to collude they effectively become one entity. And it doesn't make sense to figure out if one of both have the file.
Mar
17
comment Browser Updated, yet still vulnerable to POODLE
Do you have some shitty firewall installed that MitM's TLS?
Mar
14
comment Does this CSS code expose if a message is read, and how long they have been reading it?
Good email clients will not load external files by default.
Mar
14
revised DSA Generates different signatures with the same data
added 284 characters in body
Mar
10
comment What are the security implications of “Row Hammer” attack?
Detecting such reads and then refreshing adjacent memory rows might work. But I'm not sure which piece of hardware wouldn't be responsible for that.
Mar
6
comment Is enough to remove “..” from strings to avoid directory traversal attack?
I wonder how they implemented that function on windows.
Mar
2
comment VeraCrypt/TruCrypt - I can't understand why you'd want to create a “hidden” volume…?
@tpg2114 There have been several cases where people have been compelled to enable decryption of a password protected device.
Feb
26
comment Timsort python exploit
I think the java implementation simply crashes since java validates array indices. So it certainly doesn't lead to RCE by default. It might overwrite some unrelated data in the same array, but does limited damage with typical usage.