509 reputation
1312
bio website
location
age
visits member for 2 years
seen Nov 6 '13 at 7:07

Mar
28
awarded  Yearling
Nov
6
revised A problem with the cookie theft detection mechanism of Barry Jaspan's Improved Persistent Login Cookie scheme
deleted 75 characters in body
Nov
6
revised A problem with the cookie theft detection mechanism of Barry Jaspan's Improved Persistent Login Cookie scheme
deleted 75 characters in body
Nov
6
asked A problem with the cookie theft detection mechanism of Barry Jaspan's Improved Persistent Login Cookie scheme
Oct
11
awarded  Popular Question
Sep
20
awarded  Popular Question
Jun
21
awarded  Famous Question
Jun
16
comment using two passwords for normal and security critical functions
what if we can't afford two factor authentication?
Jun
16
revised using two passwords for normal and security critical functions
added 105 characters in body
Jun
16
asked using two passwords for normal and security critical functions
May
23
awarded  Scholar
May
23
accepted Why standards organizations give so short protection times for 128 bit encryption?
May
22
asked Why standards organizations give so short protection times for 128 bit encryption?
May
16
awarded  Nice Question
Apr
30
comment Prevent denial of service attacks against slow hashing functions?
very interesting topic generally. i bookmarked several related links to study about client puzzles/PoW. but seems to me that a C program can solve the puzzle much faster than javascript, and that seems another deficiency for web usage.
Apr
30
comment PHP - Serializing user inputs
yes i know all of that. that entropy is just an extra, not the main entropy source. also it is stored in db and is combined with each new request's entropy from every user. so the main extra entropy source (the combined entropy of all requests to the time) becomes completely unpredictable soon after enough distinct users visit the site. also i agree with u that user knows his request parameters, these parameters can't protect the server against user, but that entropy still is of use for protecting user against attackers. e.g it is used in generating users' login key, anti-csrf token, etc.
Apr
30
asked PHP - Serializing user inputs
Apr
28
comment Web & insecure HTTP - Using RSA for encrypting passwords on the client side
i think of, maybe sometimes an http request is passing through an attacker controlled machine/route only once or rarely. don't seems to me that attacker is ready and functional for preforming active attacks against all such requests belonging to different web sites with different codes. i think there is even the possibility that the corresponding response be passed through a different route, so the attacker can't get the results. but plaintext passwords from any http request going to any web site can even be detected and collected automatically.
Apr
28
comment Web & insecure HTTP - Using RSA for encrypting passwords on the client side
i think active attacks need more knowledge/skills, careful prior tests and planning, more risk of detection, more resources, tools, ... so seems not everyone can always perform active attacks effectively.
Apr
28
comment Web & insecure HTTP - Using RSA for encrypting passwords on the client side
i am not discussing about whether HTTPS should be used instead of HTTP. u think what fraction of web that should be using https is really using it? do u really think that the only reason for this is ignorance?