486 reputation
39
bio website coderinaworldofcode.blogspot.…
location
age
visits member for 2 years, 8 months
seen 25 mins ago

Research Assistant at the University of York.


Oct
24
answered SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?
Oct
16
awarded  Excavator
Oct
16
revised Security of several files all using same password/key (7zip, AES256)
Edited for grammar & spelling mistakes (e.g. intent -> intend, s/he'll -> they'll)
Oct
16
suggested suggested edit on Security of several files all using same password/key (7zip, AES256)
Sep
24
awarded  Autobiographer
Aug
28
answered What's the difference between mitm attack and sniffing?
Aug
19
comment Using last characters of hash as salt
Although I broadly agree, the choice of using >256b of entropy is probably overkill. You only need enough bits to know that, with high probability, there will be no collisions in your database; taking into account the birthday paradox. For many small databases, this can actually be a surprisingly small number of bits. I often just leave it at 128b and call it a day, but resource constrained applications will want to consider this.
Feb
23
awarded  Yearling
Oct
4
comment Can a steel woven wallet prevent RFID scanning of credit card information?
Just as an interesting aside, this technology looks very similar to the OffPocket. If the construction is sufficiently similar, I would expect it to work in a similar fashion.
Aug
2
comment BREACH - a new attack against HTTP. What can be done?
This isn't actually that much of a mitigation; you can simply collect more packets and the variation(s) will become statistically significant. Obviously, this can be an impediment and slow down an attacker, but it doesn't stop the attack. The proper fix is to close the side-channel (stop compression).
Jul
16
comment Attack on the custom token-based sha256 security scheme
You may be able to perform a variation on a length extension attack (en.wikipedia.org/wiki/Length_extension_attack), but by pre-fixing the data rather than suffixing. Without thinking about this in depth, I couldn't say for certain, but it seems reasonable at first glance.
Jun
24
answered Generate user a password instead of asking for one?
Jun
24
awarded  Commentator
Jun
14
awarded  Citizen Patrol
Jun
11
comment Security and privacy in email and other communications
In point 3, you ask about sharing your private key, do you mean your public key, since you probably shouldn't be sharing the private key :-p
May
23
comment Is it possible to encrypt a virtual machine using virtualbox?
Not quite, any one on the host machine running with sufficient privileges will be able to attach a debugger to the VM's process and read out the contents of the VM's RAM.
May
23
revised Protect java WEB application inside the server(against reverse engineering)
Grammar, spelling, ensured the question made more sense and was a bit more answerable.
May
23
suggested suggested edit on Protect java WEB application inside the server(against reverse engineering)
May
23
answered Protect java WEB application inside the server(against reverse engineering)
May
1
revised Why one time passwords using nested hash chain are not used?
Noted another form of attack on this protocol.