1,312 reputation
721
bio website
location
age
visits member for 3 years
seen Nov 18 at 22:59

Nov
13
accepted How well is the SSL/TLS handshake protected against modifications?
Nov
2
awarded  Yearling
Oct
30
comment How well is the SSL/TLS handshake protected against modifications?
That was very helpful, thank you! Out of curiosity, why is an HMAC forgery not enough? Is changing HMAC(master_key, ..., handshake_hash) to HMAC(master_key, ..., handshake_hash') not a forgery? (Of course, it would have to be a "nested forgery", since that hash is authenticated again by the selected SSL MAC, usually also HMAC, using an also unknown key. I can see that the chances of such an elaborate forgery are marginal even for MD5.)
Oct
30
revised How well is the SSL/TLS handshake protected against modifications?
added 142 characters in body
Oct
30
asked How well is the SSL/TLS handshake protected against modifications?
Oct
24
awarded  Notable Question
Oct
3
comment Does Android encryption really prevent law enforcement access?
Google still seems to be able to remotely unlock a device even when using a PIN or password as of Android 4.4. On the Android Device Manager, the existing screen lock mechanism can be replaced with a password entered in the web interface. I haven't checked what happens in case the device is encrypted, though (since this would theoretically bring the lock screen password and the encryption password out of sync).
Sep
28
revised Android L encryption vs. iOS 8 encryption
added 488 characters in body
Sep
28
answered Android L encryption vs. iOS 8 encryption
Sep
25
revised Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
added 457 characters in body
Sep
25
comment Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
Based on the content of your question, do you actually mean something like "is creating an NFC payment app using HCE, i.e. without a secure element, inherently insecure"? Apple Pay is only one of various mobile payment systems that use a secure element.
Sep
24
revised Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
added 234 characters in body
Sep
24
answered Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
Sep
5
answered NFC contactless payment security
Jul
16
accepted iOS data protection: Who decrypts files transferred over USB?
Jul
3
answered What's the point of EMV when only the card is needed to shop online?
Jul
3
answered Would chip-and-PIN have prevented the Target breach?
Jul
2
awarded  Curious
Jul
2
answered How can my bank debit card reader know that my pin is valid?
Jun
22
revised Java AES encryption output length
added 783 characters in body