138 reputation
7
bio website
location
age
visits member for 3 years, 2 months
seen 19 hours ago

Dec
21
comment Does the entire AES encrypted dataset have to be present to be 'cracked'?
+1 lol @ "security is happening"
Dec
13
asked Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better?
Dec
9
comment Timing attack against HMAC in authenticated encryption?
Kind of a tangent, but is there any guarantee that the CPU instructions take the same amount of time for different inputs?
Dec
1
comment Techniques to make a login page safe without using SSL
@Yogu: I also didn't mean TLS specifically either, that is why I wrote "transport-layer" security instead of TLS. My question still stands.
Dec
1
comment Techniques to make a login page safe without using SSL
I'm not sure I understand what the difference would be between doing encryption at the transport layer versus another layer. There's nothing special about "transport-layer" security AFAICT.
Nov
13
comment What role does clock synchronization play in SSL communcation
Relevant: imperialviolet.org/2014/04/19/revchecking.html
Nov
2
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Not sure I understand why this is correct. A hacked client needs to mimic a valid client. The hacked client cannot always be precompiled, because that would require reverse-engineering the original client which is equivalent to solving the halting problem. Therefore, for a sufficiently complicated client, the imitation must interpret the code on the fly rather than recompile it. That necessarily introduces extra delay, which can be detected by the server by measuring response times. Hence it should in principle be possible, shouldn't it?
Oct
25
awarded  Critic
Aug
20
awarded  Editor
Aug
20
revised Should I use own constants when using well known hashing algorithms?
deleted 5 characters in body
Aug
20
awarded  Teacher
Aug
20
answered Should I use own constants when using well known hashing algorithms?
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
lol that was actually completely unintentional, but I'll happily take credit for it :P
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
+1, but mind you, "who's motivated enough" is a bit misleading because there isn't exactly a lot of motivation required for this. They've already spent the time required to scrape or otherwise acquire the emails, so the extra minute required to add a regex to the mix is peanuts.
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
I remember reading (edit: here's one of the many pages that explains this) that the spelling and grammar mistakes are intentional -- they want to make sure people who respond are unlikely to be the types of people who pay careful attention to thinks (and they want others to discard the emails). Pretty sure it's not a sign of laziness.
Aug
16
awarded  Commentator
Aug
16
comment Is using 'dot' and 'at' in email addresses in public text still useful?
I didn't get any true spam at my personal addresses until just a few months ago. Probably some person or company leaked my emails then. It's certainly not true that every legitimate address gets spam.
Aug
16
comment Is using 'dot' and 'at' in email addresses in public text still useful?
@Adnan: Instead of searching for @ can't they just search for gmail or other common domains? That's going to find anything even remotely like firstname [dot] lastname [i think i'm so clever] gmail [ooh yeah] com...
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
@SilverlightFox: That's unfortunate... though I guess I can't say I'm surprised. Good to know though, thanks.
Aug
16
comment Is it better to have a camera hidden or visible?
I don't get it, why would you expect any criminal to take off the face mask after he's disabled the visible camera? Not sure what good the hidden camera would do here.