Reputation
1,800
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 9 25
Newest
 Nice Answer
Impact
~372k people reached

  • 0 posts edited
  • 2 helpful flags
  • 41 votes cast
Oct
30
comment How well is the SSL/TLS handshake protected against modifications?
That was very helpful, thank you! Out of curiosity, why is an HMAC forgery not enough? Is changing HMAC(master_key, ..., handshake_hash) to HMAC(master_key, ..., handshake_hash') not a forgery? (Of course, it would have to be a "nested forgery", since that hash is authenticated again by the selected SSL MAC, usually also HMAC, using an also unknown key. I can see that the chances of such an elaborate forgery are marginal even for MD5.)
Oct
30
revised How well is the SSL/TLS handshake protected against modifications?
added 142 characters in body
Oct
30
asked How well is the SSL/TLS handshake protected against modifications?
Oct
24
awarded  Notable Question
Oct
3
comment Does Android encryption really prevent law enforcement access?
Google still seems to be able to remotely unlock a device even when using a PIN or password as of Android 4.4. On the Android Device Manager, the existing screen lock mechanism can be replaced with a password entered in the web interface. I haven't checked what happens in case the device is encrypted, though (since this would theoretically bring the lock screen password and the encryption password out of sync).
Sep
28
revised Android L encryption vs. iOS 8 encryption
added 488 characters in body
Sep
28
answered Android L encryption vs. iOS 8 encryption
Sep
25
revised Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
added 457 characters in body
Sep
25
comment Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
Based on the content of your question, do you actually mean something like "is creating an NFC payment app using HCE, i.e. without a secure element, inherently insecure"? Apple Pay is only one of various mobile payment systems that use a secure element.
Sep
24
revised Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
added 234 characters in body
Sep
24
answered Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?
Sep
5
answered NFC contactless payment security
Jul
16
accepted iOS data protection: Who decrypts files transferred over USB?
Jul
3
answered What's the point of EMV when only the card is needed to shop online?
Jul
3
answered Would chip-and-PIN have prevented the Target breach?
Jul
2
awarded  Curious
Jul
2
answered How can my bank debit card reader know that my pin is valid?
Jun
22
revised Java AES encryption output length
added 783 characters in body
Jun
22
answered Java AES encryption output length
Apr
16
awarded  Notable Question