6,828 reputation
11734
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen yesterday

Dec
19
revised “Official statement” on php.net : CRYPT_BLOWFISH is strongest hash algorithm. Why?
deleted 9 characters in body
Dec
17
comment Is there a way to mimic http request of a compiled program?
@PeterHorvath Read Vallo's first comment. It's DRM.
Dec
16
answered Calculating D-Wave's integer factorization capabilties
Dec
16
comment Is there a way to mimic http request of a compiled program?
You want to implement some kind of licensing or DRM scheme?
Dec
16
comment Is there a way to mimic http request of a compiled program?
Why do you ask that question?
Dec
16
comment Is there a way to mimic http request of a compiled program?
Yes, e.g. with Fiddler
Dec
16
comment Are there theoretical attacks against ECC Digital Signatures?
"chosen ciphertext attack" isn't really an attack. It's more like an attack model.
Dec
16
answered Are there theoretical attacks against ECC Digital Signatures?
Dec
11
comment Prevent a file from being encrypted
Is cryptolocker really dumb enough to apply textbook RSA to the actual file contents? I consider that very unlikely. RSA is typically used with padding and typically used as hybrid encryption where it only encrypts a key for a symmetric cipher and not the file itself.
Dec
10
comment Parallel HTTPS connection remote and local host
Strict Transport Security is for a domain.
Dec
3
comment Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?
Note that the guessing attack is pretty fast. I'm too lazy to dig out the numbers, but a single GPU should be able to check more than a billion candidates per second.
Dec
3
revised Is there a method to get plain-text from cipher-text in HMAC SHA-1, given that the key is known?
deleted 62 characters in body
Dec
2
comment Do I have to hash users' IP addresses when I log them?
In Germany there are some restrictions on IP logging. I think you need to truncate them unless the storage is only for a short time. But I forgot the details.
Dec
2
comment Do I have to hash users' IP addresses when I log them?
Hashing a IPv4 address doesn't achieve anything -- it can trivially be reversed by exhaustive input enumeration.
Dec
1
comment How Regin hides running instances of itself?
As a driver you can manipulate the internal kernel data structures to remove some driver from the lists. I don't have much kernel hacking experience, but I know that several game hacks used the userland equivalent of this technique to remove their dll from the list of loaded dlls.
Dec
1
revised How Regin hides running instances of itself?
edited tags
Nov
28
reviewed Approve Level 4 merchants becoming PCI Compliant
Nov
25
comment Are there any disadvantages to encrypting the password hash?
IMO encrypting the hash is superior to a pepper/secret salt. Security wise they're the same, but a key can be changed (simply decrypt and re-encrypt the data) and it integrates better with a HSM.
Nov
25
comment Does too long a salt reduce the security of a stored password hash?
@Iszi The point of a salt it to prevent multi-target attacks, so I don't deny the security benefit of unique salts. But precomputation is just one variant of a multi-target attack. IMO people worry too much about rainbow tables compared with live multi-target attacks.
Nov
25
comment Does too long a salt reduce the security of a stored password hash?
No competent attacker would bother to create a rainbow table for 3), a direct multi-target attack is at least as efficient. A rainbow table is only useful if you want to crack passwords with the same hash at different times.