137 reputation
7
bio website
location
age
visits member for 3 years, 8 months
seen yesterday

1d
comment Why can't reverse engineering be automated?
@raz: I certainly don't, and I don't think the majority of people think of that as engineering either. The first definition I saw when I looked up the word "engineering" in my desktop dictionary was exactly what I expected, "application of science to designing things". You can go ahead and argue that screwing pieces together is engineering if you'd like, which you're free to do but which I'm not going to entertain.
1d
comment Why can't reverse engineering be automated?
@raz: I didn't know working on an assembly line was called engineering.
Jun
24
comment Why can't reverse engineering be automated?
Can forward engineering be automated?!
Jun
11
comment How do I report a security vulnerability about a trusted certificate authority?
Hi Ryan, I just noticed this: it's a bit strange (and rather ironic) that the Chrome Security FAQ isn't an HTTPS link. It might be useful to fix that so everyone who is in a secure context can view the security page securely.
Jun
1
comment TrueCrypt vs BitLocker
Your claim that it is unknown whether BitLocker has a backdoor seems to contradict the one below, which claims the source code has been reviewed by large companies. (That is, unless you're claiming it is plausible that the large companies have missed the backdoors, which seems on par with missing backdoors in TrueCrypt.)
May
14
comment Ensure that a file can only be decrypted after a specific date
You have to think about your question a little to see if it even makes sense. Who sets the date and time in the first place? If Congress decides that daylight savings is suddenly ending right now, and your file had just become decryptable 10 seconds ago, do you really expect it to become sealed again? If you cross a country border, is your file somehow supposed to react to that? Isn't it pretty obvious that being able to decrypt the file must necessarily require the cooperation of whoever is decreeing the current date/time?
Mar
28
comment Should I be concerned if my website throws stack information?
So security through obscurity is useful after all, who knew.
Mar
13
comment Is it legal to start a private website for you and your friends to hack?
What incentive does the ISP have to say "yes" if it's allowed?
Jan
15
comment If you send a bitcoin payment to a seller, will they learn your IP address?
@ThomasStets: Uhm so whom exactly does your Bitcoin client contact when you want to make a transaction, then? All 4 billion IPv4 addresses? If not, then how is this receiver chosen?
Dec
21
comment Does the entire AES encrypted dataset have to be present to be 'cracked'?
+1 lol @ "security is happening"
Dec
13
asked Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better?
Dec
9
comment Timing attack against HMAC in authenticated encryption?
Kind of a tangent, but is there any guarantee that the CPU instructions take the same amount of time for different inputs?
Dec
1
comment Techniques to make a login page safe without using SSL
@Yogu: I also didn't mean TLS specifically either, that is why I wrote "transport-layer" security instead of TLS. My question still stands.
Dec
1
comment Techniques to make a login page safe without using SSL
I'm not sure I understand what the difference would be between doing encryption at the transport layer versus another layer. There's nothing special about "transport-layer" security AFAICT.
Nov
13
comment What role does clock synchronization play in SSL communcation
Relevant: imperialviolet.org/2014/04/19/revchecking.html
Nov
2
comment Is it fundamentally possible to validate that an unmodified version of your client connects to your server?
Not sure I understand why this is correct. A hacked client needs to mimic a valid client. The hacked client cannot always be precompiled, because that would require reverse-engineering the original client which is equivalent to solving the halting problem. Therefore, for a sufficiently complicated client, the imitation must interpret the code on the fly rather than recompile it. That necessarily introduces extra delay, which can be detected by the server by measuring response times. Hence it should in principle be possible, shouldn't it?
Oct
25
awarded  Critic
Aug
20
awarded  Editor
Aug
20
revised Should I use own constants when using well known hashing algorithms?
deleted 5 characters in body
Aug
20
awarded  Teacher