417 reputation
37
bio website coderinaworldofcode.blogspot.…
location
age
visits member for 2 years, 5 months
seen Jul 26 at 11:02

Research Assistant at the University of York.


Feb
23
awarded  Yearling
Oct
4
comment Can a steel woven wallet prevent RFID scanning of credit card information?
Just as an interesting aside, this technology looks very similar to the OffPocket. If the construction is sufficiently similar, I would expect it to work in a similar fashion.
Aug
2
comment BREACH - a new attack against HTTP. What can be done?
This isn't actually that much of a mitigation; you can simply collect more packets and the variation(s) will become statistically significant. Obviously, this can be an impediment and slow down an attacker, but it doesn't stop the attack. The proper fix is to close the side-channel (stop compression).
Jul
16
comment Attack on the custom token-based sha256 security scheme
You may be able to perform a variation on a length extension attack (en.wikipedia.org/wiki/Length_extension_attack), but by pre-fixing the data rather than suffixing. Without thinking about this in depth, I couldn't say for certain, but it seems reasonable at first glance.
Jun
24
answered Generate user a password instead of asking for one?
Jun
24
awarded  Commentator
Jun
14
awarded  Citizen Patrol
Jun
11
comment Security and privacy in email and other communications
In point 3, you ask about sharing your private key, do you mean your public key, since you probably shouldn't be sharing the private key :-p
May
23
comment Is it possible to encrypt a virtual machine using virtualbox?
Not quite, any one on the host machine running with sufficient privileges will be able to attach a debugger to the VM's process and read out the contents of the VM's RAM.
May
23
revised Protect java WEB application inside the server(against reverse engineering)
Grammar, spelling, ensured the question made more sense and was a bit more answerable.
May
23
suggested suggested edit on Protect java WEB application inside the server(against reverse engineering)
May
23
answered Protect java WEB application inside the server(against reverse engineering)
May
1
revised Why one time passwords using nested hash chain are not used?
Noted another form of attack on this protocol.
May
1
answered Why one time passwords using nested hash chain are not used?
Apr
15
awarded  Outspoken
Mar
15
awarded  Yearling
Feb
28
revised How less secure is an encryption if we know something about the original data?
Made the note about AES not being vulnerable more correct -- it may become vulnerable in the future.
Feb
28
suggested suggested edit on How less secure is an encryption if we know something about the original data?
Feb
25
comment Password reset links: random value or authenticated message?
The basic idea is to defend the token (which is a password-equivalent) with the same level of protections that come with protecting a password. You should also be very wary of timing attacks against the one-time tokens.
Feb
23
answered Password reset links: random value or authenticated message?