Reputation
63,399
Next tag badge:
1520/400 score
75/80 answers
Badges
17 155 253
Impact
~2.8m people reached

Dec
14
comment What is a YubiKey and how does it work?
@Celeritas Malware or exploitation of the system cannot trivially "trick" the YubiKey into giving up its password, as you need to press the physical button to type it. A value on a USB stick can just be read off.
Dec
4
comment HTTPS request break down
Also see security.stackexchange.com/questions/30976/…
Dec
4
comment HTTPS request break down
This is not correct, or is at least very misleading. GET parameters are encrypted.
Dec
4
awarded  Enlightened
Dec
4
awarded  Nice Answer
Dec
4
comment Why handshake is not initiated for google webserver?? Is there any client side validation before handshake is initiated?
@SteffenUllrich While that should be the case, Burp does seem to have trouble with SPDY sometimes. I've run into cases where it just won't show the traffic at all, or the requests show up but no response comes back.
Dec
4
comment 4 Hackers on my network!
Yeah, you got scammed.
Dec
4
answered Why handshake is not initiated for google webserver?? Is there any client side validation before handshake is initiated?
Dec
4
awarded  Nice Answer
Dec
3
comment Is my developer's home-brew password security right or wrong, and why?
@monster Having access to the code is not the same as having access to the values of variables at runtime. That's an entirely different scenario. Just having an offline copy of the code should not affect the security of the cryptographic system.
Dec
3
awarded  Good Answer
Dec
1
comment How can a website find my real IP address while I'm behind a proxy?
@jiggunjer Javascript won't bypass the proxy. Java applets can choose to. Java and Javascript are not the same thing.
Dec
1
comment Is my developer's home-brew password security right or wrong, and why?
@monster See Kerckhoff's Principle. Never design a system where you assume that the attacker doesn't know the process. A cryptographic function should rely upon the secrecy of the key, not the secrecy of the algorithm.
Nov
4
comment Testing a hardware random number generator
@sampablokuper Stealthy Dopant-Level Hardware Trojans - Becker et. al.. Theodore Ts'o also wrote a PoC to demonstrate an attack on RDRAND by modifying the instruction's behaviour in bochs: Twitter link, explanation
Oct
29
comment Java with LIS system
@Philipp Depends on the config, but don't underestimate what people will do on servers.
Oct
28
awarded  Popular Question
Oct
27
answered Java with LIS system
Oct
27
revised Java with LIS system
formatting
Oct
27
comment Is MD5 ok to use if salted?
For what purpose?
Oct
21
awarded  Nice Answer