Reputation
2,148
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
4 24
Newest
 Talkative
Impact
~79k people reached

2d
comment What is the state of cryptographic obfuscation in 2015?
@PyRulez, I've been trying to follow this area as time permits. I will try to write up an answer.
2d
comment What is the state of cryptographic obfuscation in 2015?
One "state" of the technology is that DARPA is spending lots of money on it. See SAFEWARE. My guess is that it is changing pretty rapidly.
2d
comment What is the state of cryptographic obfuscation in 2015?
You might try having this migrated to Crypto.SE.
Sep
1
comment download file/folder anonymously on a ssh session
The method I linked to should also automatically torify scp, so you don't need to specify your private ip address.
Sep
1
comment download file/folder anonymously on a ssh session
Have you tried this: howtoforge.com/anonymous-ssh-sessions-with-tor
Aug
27
comment Cloudflare's free SSL options require trusting them; what could they do to change that?
TLS/SSL has never necessarily meant end to end encryption. For example, I can setup a reverse-proxy load balancer that forwards connections all over the world. The connection to the reverse-proxy load balancer might be over TLS, but the connections to the servers "behind" the reverse-proxy won't necessarily be. And those machines could be spread all over the world.
Aug
19
comment keytool -genseckey -alias TDES -keyalg DESede -keysize 128 works within jre/bin folder but not when the keytool.exe is on another location
Why would you want to create a key with a length that isn't supported with TDES?
Aug
4
comment Why does gpg use /dev/urandom
Do you have a reference for your statement that messages are vulnerable to a low entropy session key (with GPG 1.4)? AFAIK, there is no low entropy attack on 1.4. See Thomas's answer.
Jul
29
comment How can common users defend against the StageFright vulnerability?
Install TextSecure, it isn't vulnerable to this attack. As an added bonus, you can get end-to-end encrypted texts.
Jul
25
comment Why is my internal IP address (private) visible from the Internet?
The second chrome extension you linked to appears to work fine for me.
Jul
24
comment How can I find the origin of an IP address for a relayed IP?
What are you going to do if you find the IP address? Chances are, you can't. It is so easy to cover your tracks when doing something like this. Better just get the backend fixed as soon as possible.
Jul
24
comment Using RSA for Web Application Authentication
@GoFYerPedantry In fact, look at this comment. You sure you don't have two accounts :)
Jul
24
comment Using RSA for Web Application Authentication
BTW, just found this question you may be interested in.
Jul
24
comment Using RSA for Web Application Authentication
@GoFYerPedantry, true, true. Another possibly cool option would be to have the ssh connection (in addition to establishing the tunnel) return a one-time-use auth token for the user. Not sure how that would be passed to the browser, though.
Jul
24
comment Using RSA for Web Application Authentication
@GoFYerPedantry if an attacker can inject javascript, and the private key is loaded into the javascript memory, they can also get it. That to me is a bigger concern since then they could establish the SSH connection. But you did say you weren't worried about protecting the server from malicious clients :)
Jul
24
awarded  Talkative
Jul
24
answered Using RSA for Web Application Authentication
Jul
24
comment Using RSA for Web Application Authentication
Let us continue this discussion in chat.
Jul
24
comment Using RSA for Web Application Authentication
How does the browser get access to the SSH-RSA key pair?
Jul
24
comment Using RSA for Web Application Authentication
What's a threat model? well, you've already started building yours by answering my questions. You are not worried about protecting clients from a malicious server and not worried about protecting the server from malicious clients.