Reputation
8,008
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 23 38
Newest
 Enlightened
Impact
~393k people reached

Feb
5
reviewed Approve Is there an encryption algorithm that is fully secure?
Feb
5
comment Is there an encryption algorithm that is fully secure?
Also Polynomial MACs are secure against computationally unbounded attackers (but there is an exponentially small chance that the attacker simply gets lucky when forging a tag). You can combine them with an OTP to provide integrity protection.
Feb
5
comment Is there an encryption algorithm that is fully secure?
You can drop the "which is known to day" part. You can prove that any perfectly secure encryption needs a key that's at least as long as the message. So while the details of the algorithm can vary (e.g. you could design it to be stateless or to be still computationally secure on pad reuse), it'll always share the keying requirements of the OTP.
Feb
2
comment Turning hex string into readable chars
If it's compressed with deflate, offzip should be able to find it: reverseengineering.stackexchange.com/questions/1463/…
Feb
1
comment Explain to non tech savvy person how to check that your connection to mybank.com is safe?
I'd recommend using a bookmark. That way you can only be tricked on the first access.
Jan
31
comment Verifying android application integrity from server side
@immibis I consider acting in the interests of its owner the most important duty of a computer. Thus I consider it justified to call a piece of hardware that's willing to testify against its owner treacherous. But I'm open to other descriptions, if you have any good ideas.
Jan
31
comment Verifying android application integrity from server side
It's called remote attestation and only works if the device contains treacherous hardware. There have been multiple attempts to introduce such features (TCPA, TPM, Intel SGX,...) but I don't know if typical android devices contain such a feature.
Jan
31
comment Hacker attempting to get into my Skype and Chrome
Looks like you might be a scareware victim.
Jan
24
comment How to protect Windows Registery from being changed or from programs trying to add keys
The registry has shared parts which can only be changed by an admin, and per-user parts which can be changed by unprivileged applications of that user.
Jan
18
comment Can we drop XP from HTTPS support? If not, when?
The security of modern clients only suffers from offering weak ciphersuites/protocol versions if they're vulnerable to downgrade attacks.
Jan
14
comment Reading physical memory frame previously owned by another process to read contents of its memory page
GPU memory doesn't get zeroed reliably (at least on some OS) and the GPU vendors seem to be unwilling to fix that in their drivers, despite knowing about that security vulnerability for years.
Jan
4
comment Policy mandate dilemma
Just create a policy forbidding dumpster diving. :)
Dec
30
comment What are the problems of using OTP encryption with TRNG?
If "merely" cryptographically secure is enough, you could use a stream cipher. The whole point of an OTP is that it's secure against computationally unbounded adversaries and can't fall to advancing cryptoanalysis.
Dec
30
comment What are the problems of using OTP encryption with TRNG?
CryptGenRandom is no true RNG. So you get the annoyance of a large pad and the inability to use public key crypto but don't benefit from the information theoretical guarantee of an OTP.
Dec
22
comment Is 8192 Diffie-Hellman overkill?
Keys used for confidentiality need remain secure for as long as the data needs to remain confidential. Keys used for authentication only need to be secure for as long as they're in use. So it makes sense to use bigger keys for confidentiality.
Dec
17
comment How WhatsApp identifies a specific user
Of course being able to receive SMS sent to that number gives you the ability to obtain an account for that number. But using a token as several advantages over storing the code. 1) The code has likely low entropy, so using as little as possible and limiting its lifetime is a good idea. 2) The code can be copied by a malicious network. When you store that code directly, this leads to silent impersonation, whereas activating a separate token means that the attacker has to register an additional device that can be listed in a device list.
Dec
17
comment How WhatsApp identifies a specific user
Both approaches sound bad to me. I'd rather store a cryptogaphic key or token in the application's config and only use the SMS code as one-time activation of that key.
Dec
12
comment Is using Chrome and Tor Browser at the same time secure?
Tor Browser is based on Firefox. Firefox refers to its UI as chrome, so the error is almost certainly unrelated to Google-Chrome.
Dec
9
comment Can any password hash ever be secure?
@Benu Your question is about passowrd hashes, right? Since you mentioned deliberately slow hashes.
Dec
9
revised Can any password hash ever be secure?
edited title