Reputation
63,424
Next tag badge:
1520/400 score
75/80 answers
Badges
17 155 253
Impact
~2.8m people reached

Feb
10
comment Is it safe to binary-deserialize user-provided data?
@deed02392 It's just part of an example of a class someone might write.
Feb
5
comment Is this c# digital signature implementation secure?
Without going into a full answer, there are issues here. You're using strings a lot (they're immutable and won't be cleared by the GC reliably), you've not checked that results are as expected (e.g. using fixed array indices from split strings without checking array length), there's no exception handling, etc.
Jan
12
comment What is a YubiKey and how does it work?
@ott The round contact is for you to press. It's what triggers it to type its stored data.
Dec
16
comment Is my developer's home-brew password security right or wrong, and why?
@monster That's a common way of denoting placeholder variables, hence why the comment says "user data". They'll be filled in with actual values from the calling code.
Dec
15
comment Sign GnuPG master key with own X.509 certificate?
@MatheusMoreira With WoT the signatures are distributed via some kind of central lookup service, just like regular keyservers. Alternatively you can just email the signatures to each other. The distribution isn't really critical.
Dec
15
comment Sign GnuPG master key with own X.509 certificate?
@MatheusMoreira To answer the questions in your second comment: you could use an X.509 certificate for your website, issued by a CA, but that's not the same as an identity certificate for a person. However, if people recognise the domain as yours (e.g. from your business card) you could distribute your public key via that site and use the fact that it's valid SSL to provide some assurance, moreso if Extended Validation (EV) is provided.
Dec
15
comment What is a YubiKey and how does it work?
@Celeritas Many RATs allow an attacker to browse the filesystem manually. Others will just dump removable drive contents for common document types (txt, doc, xls, docx, xlsx, mdb, etc.) and send them off to the C&C. You also have to keep in mind that the YubiKey offers CHAP-style authentication for 2FA, rather than just static-key auth, which is entirely superior to saving a password to a USB stick.
Dec
14
comment Using AES with same salt / IV - required for pattern matching algorithm
The keyword you want here is searchable encryption. There's a good series here.
Dec
14
comment What is a YubiKey and how does it work?
@Celeritas Malware or exploitation of the system cannot trivially "trick" the YubiKey into giving up its password, as you need to press the physical button to type it. A value on a USB stick can just be read off.
Dec
4
comment HTTPS request break down
Also see security.stackexchange.com/questions/30976/…
Dec
4
comment HTTPS request break down
This is not correct, or is at least very misleading. GET parameters are encrypted.
Dec
4
comment Why handshake is not initiated for google webserver?? Is there any client side validation before handshake is initiated?
@SteffenUllrich While that should be the case, Burp does seem to have trouble with SPDY sometimes. I've run into cases where it just won't show the traffic at all, or the requests show up but no response comes back.
Dec
4
comment 4 Hackers on my network!
Yeah, you got scammed.
Dec
3
comment Is my developer's home-brew password security right or wrong, and why?
@monster Having access to the code is not the same as having access to the values of variables at runtime. That's an entirely different scenario. Just having an offline copy of the code should not affect the security of the cryptographic system.
Dec
1
comment How can a website find my real IP address while I'm behind a proxy?
@jiggunjer Javascript won't bypass the proxy. Java applets can choose to. Java and Javascript are not the same thing.
Dec
1
comment Is my developer's home-brew password security right or wrong, and why?
@monster See Kerckhoff's Principle. Never design a system where you assume that the attacker doesn't know the process. A cryptographic function should rely upon the secrecy of the key, not the secrecy of the algorithm.
Nov
4
comment Testing a hardware random number generator
@sampablokuper Stealthy Dopant-Level Hardware Trojans - Becker et. al.. Theodore Ts'o also wrote a PoC to demonstrate an attack on RDRAND by modifying the instruction's behaviour in bochs: Twitter link, explanation
Oct
29
comment Java with LIS system
@Philipp Depends on the config, but don't underestimate what people will do on servers.
Oct
27
comment Is MD5 ok to use if salted?
For what purpose?
Sep
13
comment Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?
@tsorn Yes, essentially, which is something that cryptographic hash functions do not provide.