2,528 reputation
11222
bio website
location
age
visits member for 3 years, 2 months
seen 2 hours ago

May
14
revised Is my computer at risk of being hacked when using public Wi-Fi?
added second answer
May
14
answered Is my computer at risk of being hacked when using public Wi-Fi?
May
11
awarded  Necromancer
Apr
3
comment Why AES is not used for secure hashing, instead of SHA-x?
"no POV about it" Your "POV" is that you want the clear-text from the cypher-text. My "POV" is that I want the key from clear-text and cypher-text. My intuition was that most used cyphers implement one-way function. (Thomas explained my intuition really well.)
Apr
3
comment Why AES is not used for secure hashing, instead of SHA-x?
"A cipher is reversible" That a POV; from another POV: can you guess the key from cypher-text? "A cipher requires a key, a hash does not" That's a good one. It seems that "hash does not have a key" is what makes hashing more difficult than encryption.
Apr
2
awarded  Nice Question
Mar
8
comment Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
There is no "TLSA RR" used in Chrome, or any unusual RR. The DNSSEC proof is sent (in place of the usual certificate chain) in the TLS session itself, so no DNS special configuration, DNS server support, DNS resolver support ... is needed. The firewall will see no "strange" packets, and this might work in special conditions where full IP connectivity is not a given (like a Wifi captive portal).
Dec
30
comment What are the security risks in enabling ipv6
"less immature" ?
Dec
30
comment What implications does IPv6 have for internet worms and script kiddies?
"trying to authenticate remote systems based on IP address" and not also checking routing headers at the same time...
Dec
29
comment Is IPv6 with NAT less secure than IPv4?
"are assigning at least /56 to end users" Free SAS assigns /60 per box (but you can only use /64 unless you use your modem instead of the box).
Dec
2
comment How is a worm different from a virus?
"Strictly speaking, a "virus" is a piece of executable code that is attached (usually prepended) to an existing program." so a boot sector virus is not a virus?
Dec
2
comment How is a worm different from a virus?
"Biologically, a virus is a piece of RNA." or DNA.
Dec
2
comment Bypassing a captive portal with tor
"Some captive portals work only by redirecting default DNS to a login portal." so the portal gives incorrect DNS answers? with a small TTL?
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
One thing that people do not understand about biometrics: your body is here, so you can be authenticated here. It only works if there is a trusted scanner where you are. It does not work remotely. It is useless for authentication on the net.
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
(...) I wrote: "Your body is not a password." it means: "Your body is not a secret string of octets that could be transmitted on a wire." You are not a string of octets, and you are not "secret". The biometric recorded image of you that the scanner compares to you is not always a "secret" (your face, your fingerprints are hardly secrets by any reasonable definition of secrecy). That biometric information can easily be captured by anyone without your knowledge. (Same for DNA, BTW.)
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
(...) "An insecure scanner can keep a copy of that stream of bits and reuse it without your presence." Yes, but he would have to build a replica of you matching this "stream of bits". For fingerprints, this is not very difficult.
Dec
1
comment Why do we even use passwords / passphrases next to biometrics?
Again, I think you misunderstand biometrics. You are using your body to authenticate to the scanner. The scanner is authenticating you. The scanner is trusted by definition. "An insecure scanner can keep a copy of that stream of bits and reuse it without your presence." There is no "stream of byte" that can be reused. The scanner output is just "this is ddyer's body." (possibly encrypted with the scanner's key). Your body is not a password. The traditional version of a "scanner" is a guard who can recognise you (and cannot output a "stream of bits" that is your password).
Nov
25
comment Timing attacks on password hashes
@emboss "Today's hash functions are no (pseudo-) random functions." how do you define "(pseudo-) random"?
Nov
25
comment Timing attacks on password hashes
@emboss "Collison resistance does not imply randomness per se." collision resistance is not even relevant here
Nov
25
comment Timing attacks on password hashes
@emboss "only a collision-resistant (compression) function" Hug?