Reputation
111,359
Next tag badge:
95/100 score
25/20 answers
Badges
13 197 323
Newest
 Good Answer
Impact
~3.9m people reached

Nov
18
comment when to escape user input
"Escaping" is related to interpretation of data. In most text-based languages (e.g. SQL, HTML...), there are literal values which are strings of characters; most of the characters just stand for themselves, but a few trigger special processing. For instance, in a string delimited by double-quotes, the " character triggers the end of string. If you want to include a double-quote in the string contents, then that special behaviour must be deactivated. "Escaping" is replacing a character x into a sequence (starting with another special char) that results in a non-special x (e.g. \").
Nov
17
comment Secure Configuration of Ciphers/MACs/Kex available in SSH
@pioto: not to my knowledge. There is still no known attack that would apply to a SSH connection. OpenSSH's defaults may have changed, though, because they must not only choose only secure algorithm, but they must also contend with the feelings of their user base, which are notoriously subject to drift over times.
Nov
17
awarded  Good Answer
Nov
16
awarded  Good Answer
Nov
15
awarded  Nice Answer
Nov
11
answered Will OpenSSL's TLS-SRP still provide PFS if all credentials are public?
Nov
9
awarded  Enlightened
Nov
9
awarded  Nice Answer
Nov
6
answered Properly generating RSA+AES keys
Nov
6
answered what are the differences between TLS and SSL?
Nov
6
awarded  diffie-hellman
Nov
5
awarded  Guru
Nov
4
awarded  Nice Answer
Nov
4
awarded  Guru
Nov
4
awarded  Good Answer
Nov
4
answered What benefits do Hardware Security Modules provide when keys are not stored inside them?
Nov
3
awarded  Enlightened
Nov
3
awarded  Nice Answer
Nov
3
comment What DH Group size do TLS Ephemeral DHE ciphers use?
The server sends the modulus, generator, and its public DH value in the ServerKeyExchange. The client then learns all of these; the client will send its public DH value in the ClientKeyExchange, which occurs later on in the handshake. (Note that the client must know the complete modulus, not just its size. In DH, all computations must be done modulo the same prime p.)
Nov
3
answered What DH Group size do TLS Ephemeral DHE ciphers use?