155,061 reputation
25324526
bio website bolet.org/~pornin
location Quebec City, Canada
age 39
visits member for 4 years
seen 11 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Sep
18
answered How difficult is it to crack salt portion of hash
Sep
17
awarded  Nice Answer
Sep
17
awarded  Nice Answer
Sep
17
answered Entering passwords at public computers
Sep
17
reviewed Approve Securing Publicly Exposed MySQL Database for Group CS Project
Sep
17
reviewed Approve Avoid third party access to system
Sep
16
reviewed Approve Malware Suddenly Uploaded To My Website!
Sep
16
answered Is it safe to use TunnelBear VPN
Sep
15
comment How to detect the NSA MITM attack on SSL?
@Gilles: it may be worth noting that though MD5 is sufficiently broken to allow the crafting of two distinct certificates which hash to the same value, it is not broken enough to allow the crafting of an extra certificate which hashes to the same value as a given, non-malicious certificate.
Sep
14
comment Is generating random numbers using a smartphone camera a good idea?
@luiscubal: in what I describe, there is no PRNG until you have a seed, so your question does not make not a lot of sense. Except if you consider that you already have an existing PRNG and you want to "enhance" its randomness; in that case, XORing the PRNG output with the image "as is" does not "enhance" the initial PRNG much, because a normal picture will have large biased, non-random areas. For proper randomness, you really need to harvest and concentrate all the entropy (the initial hash) and then expand it back (with a PRNG).
Sep
14
awarded  Nice Answer
Sep
14
answered Is generating random numbers using a smartphone camera a good idea?
Sep
14
answered Are self-signed certificates actually more secure than CA signed certificates now?
Sep
14
awarded  Enlightened
Sep
14
awarded  Nice Answer
Sep
13
reviewed Approve Best security practices in internet cafe
Sep
13
answered Is there any way to cryptographically hash a human thumbprint?
Sep
13
answered SQL Injection with pass MD5
Sep
13
comment SQL Injection with pass MD5
Note though that the "brokenness" of MD5 for password hashing is NOT the bit about MD5 collisions; collisions are irrelevant to password hashing. Problems with MD5 are that it is way too fast, and also unsalted.
Sep
12
answered How does a weakness in a random number generator lead to a compromise of the entire cryptographic process?