Reputation
63,210
Next tag badge:
1507/400 score
75/80 answers
Badges
17 155 252
Newest
 Nice Answer
Impact
~2.8m people reached

1d
comment Is this c# digital signature implementation secure?
Without going into a full answer, there are issues here. You're using strings a lot (they're immutable and won't be cleared by the GC reliably), you've not checked that results are as expected (e.g. using fixed array indices from split strings without checking array length), there's no exception handling, etc.
1d
answered Time of working generating hash with sha2
1d
revised Which of the TLS/SSL and IPsec protocols is effective?
Fixed formatting, image, and tags
Jan
16
awarded  Nice Answer
Jan
12
comment What is a YubiKey and how does it work?
@ott The round contact is for you to press. It's what triggers it to type its stored data.
Jan
10
awarded  Enlightened
Jan
10
awarded  Nice Answer
Jan
5
awarded  Notable Question
Jan
2
awarded  Good Answer
Jan
1
awarded  Nice Answer
Dec
28
awarded  Popular Question
Dec
16
answered What can be tracked by my boss if I am logged into my work Gmail but using private Wi-Fi at home
Dec
16
comment Is my developer's home-brew password security right or wrong, and why?
@monster That's a common way of denoting placeholder variables, hence why the comment says "user data". They'll be filled in with actual values from the calling code.
Dec
15
comment Sign GnuPG master key with own X.509 certificate?
@MatheusMoreira With WoT the signatures are distributed via some kind of central lookup service, just like regular keyservers. Alternatively you can just email the signatures to each other. The distribution isn't really critical.
Dec
15
comment Sign GnuPG master key with own X.509 certificate?
@MatheusMoreira To answer the questions in your second comment: you could use an X.509 certificate for your website, issued by a CA, but that's not the same as an identity certificate for a person. However, if people recognise the domain as yours (e.g. from your business card) you could distribute your public key via that site and use the fact that it's valid SSL to provide some assurance, moreso if Extended Validation (EV) is provided.
Dec
15
comment What is a YubiKey and how does it work?
@Celeritas Many RATs allow an attacker to browse the filesystem manually. Others will just dump removable drive contents for common document types (txt, doc, xls, docx, xlsx, mdb, etc.) and send them off to the C&C. You also have to keep in mind that the YubiKey offers CHAP-style authentication for 2FA, rather than just static-key auth, which is entirely superior to saving a password to a USB stick.
Dec
15
answered Sign GnuPG master key with own X.509 certificate?
Dec
14
comment Using AES with same salt / IV - required for pattern matching algorithm
The keyword you want here is searchable encryption. There's a good series here.
Dec
14
comment What is a YubiKey and how does it work?
@Celeritas Malware or exploitation of the system cannot trivially "trick" the YubiKey into giving up its password, as you need to press the physical button to type it. A value on a USB stick can just be read off.
Dec
4
comment HTTPS request break down
Also see security.stackexchange.com/questions/30976/…