184,586 reputation
28400615
bio website bolet.org/~pornin
location Quebec City, Canada
age 40
visits member for 4 years, 8 months
seen 4 hours ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


Feb
12
revised Why are private certificates not trusted?
edited tags
Feb
12
answered Why are private certificates not trusted?
Feb
12
comment How to securely hash passwords?
Ah ! Not so fast. There is now an open competition for defining new algorithms; deadline for candidate submission is March 31st. The submission reports for some candidates will probably explain at length why their candidate is better than scrypt. Thus, two months from now, we shall have enough information to be able to reach a conclusion on "scrypt or not scrypt" (e.g. there have been suggestion that scrypt's "memory hardness" is more expensive than previously envisioned on multi-core servers).
Feb
12
awarded  Nice Answer
Feb
12
awarded  Nice Answer
Feb
11
reviewed Reject Bad practice to have a “god” password?
Feb
11
answered Does (online) poker require cryptographically secure randomness?
Feb
11
answered SSO via HMAC and shared key. Can this be improved?
Feb
11
reviewed Approve Could using a generated key from an online service be considered a risk?
Feb
8
comment What chars should I not allow in passwords?
On a typical keyboard, the space bar makes a distinctive sound, making it an easy prey for shoulder surfers.
Feb
8
awarded  Necromancer
Feb
7
answered Why do GUI terminals allow the pasting of control characters?
Feb
7
answered Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords?
Feb
7
reviewed Approve Should I reject obviously poor passwords?
Feb
7
answered Zlib DEFLATE decompression bomb
Feb
7
awarded  Nice Answer
Feb
6
awarded  Guru
Feb
6
comment Does the principle of the CRIME & BEAST attack affect VPNs?
Let me explain the setup: victim is in a coffee shop. He has a browser open. Then he wants to access some work-related site, and he fires up his VPN for that. The browser is still up and running; depending on the VPN configuration, it may leave alone connections which are not for the inner site, and these can be infected with evil Javascript. The CRIME setup is complete. Alternative: the attacker sends an email to the victim at that moment, with a link to cute kitten photos (a targeted email, not a mindless spam).
Feb
6
comment Does the principle of the CRIME & BEAST attack affect VPNs?
Capturing the ciphertext has never been a problem. In fact, the VPN uses encryption precisely because capturing the ciphertext is not a problem.
Feb
6
answered Does the principle of the CRIME & BEAST attack affect VPNs?