21,155 reputation
356107
bio website stackexchange.com/users/…
location
age
visits member for 4 years, 6 months
seen 9 hours ago

Moderator♦ pro tempore on French Language, Computer Science and Software Recommendations. I'm also a unix amateur, and a developer on embedded systems with a computer science background and security leanings by trade.

Avatar picture slightly adapted from a photo by Luridiformis (Zonda Grattus).


1d
comment Why did Facebook not use HSTS for a long time after it became available?
It would be interesting if you could update this answer to explain what made Facebook switch to HSTS. What made the reasons not to switch less compelling?
1d
revised Why did Facebook not use HSTS for a long time after it became available?
reword the question now that its premise is no longer current; general polishing
1d
reviewed Leave Closed Which remote/cloud backup solution is encrypted, works with network drives, and sends/receives data efficiently?
1d
comment Which remote/cloud backup solution is encrypted, works with network drives, and sends/receives data efficiently?
This question is off-topic here: this site is about security, not about finding suppliers, even if the security of the supplied service matters. Furthermore, your question is not suitable for Software Recommendations if you're looking for a service provider (@WhiteWinterWolf please note, this is mentioned in the tour page: hosting recommendations are off-topic). It would be on-topic on Software Recommendations if you were looking for software to run on your own servers, but this doesn't appear to be the case.
May
22
comment Can I use AES CTR mode to encrypt files with same key and nonce?
The model is that the attacker would only ever get the latest ciphertext, i.e. C₂, because the card is either in Rak's possession (then encryption is irrelevant) or stolen (with a single copy of the ciphertext). An answer here needs to explain why this is not a good model.
May
22
comment Can I use AES CTR mode to encrypt files with same key and nonce?
I think the point of the question is that the asker believes that the adversary would not get hold of C₁, so this attack would not be possible.
May
18
revised How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?
edited title
May
17
comment Designing a security system for road pricing
If you're typing the letters R-S-A into your design you're doing it wrong. At this stage, what you need to think of is assets (what needs protecting), principals (who cares about what), threats (what could go wrong), etc. The choice of algorithms is a detail to be finalized later.
May
16
comment Expand user login in Path - Filter malicious values
“If the user is not authorized the authorized_keys file will be truncated.” So any login with incorrect credentials but a valid user name disables the account? That's bizarre. What could motivate such a huge built-in denial of service?
May
15
revised Is hashing a string a secure manner for generating passwords?
append + SHA-256 is a good KDF. What it fails to do which is necessary for passwords is stretching.
May
15
awarded  Nice Answer
May
14
comment Is a website published in an obscure directory comparably secure to being placed behind a login?
@HagenvonEitzen Do people still use basic HTTP authentication these days?
May
12
comment Is a website published in an obscure directory comparably secure to being placed behind a login?
@CodeMoose I really struggle to understand your comment. My answer is pretty much only “here's the x, y, z factors you haven't considered”, and I nowhere say anything like “this isn't a realistic question”. It's a realistic and reasonable question, and the answer is a strong no.
May
12
comment Is a website published in an obscure directory comparably secure to being placed behind a login?
@CodeMoose Feedback that just says “wrong password” isn't useful feedback. Accidental indexing is not a moot point, it's a pretty common risk. I'm reasonably confident that I have understood the question, and I addressed quite a few of your points directly.
May
12
answered Is a website published in an obscure directory comparably secure to being placed behind a login?
May
11
comment Too many open ports in Debian 8
Also posted on Unix & Linux. Don't do this.
May
9
reviewed Close Determine private key size using public certificate
May
9
reviewed Close Is there a use-case that renders the password manager obsolete?
May
8
reviewed Leave Open Why aren't all photo-IDs/cards digitized these days, for security/convenience?
May
8
reviewed Close Why does Chrome display "Your connection to website… However, this page includes other resources which are not secure…”?