Reputation
3,368
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
5 16
Newest
 Good Answer
Impact
~107k people reached

  • 0 posts edited
  • 5 helpful flags
  • 59 votes cast
Aug
28
answered How does a hacker know how many times a password was hashed?
Aug
26
comment Usage of Ephemeral Diffie-Hellman ciphers in 2015 and beyond
@Tom17 Yes, you can disable specific ciphers in Chrome by passing them in a list as a command-line argument when you run it: fehlis.blogspot.co.uk/2013/12/…. And if you disable ECDHE it doesn't mean that most sites will fail, because you will fall back on RSA for sites that don't support DHE.
Aug
25
comment Usage of Ephemeral Diffie-Hellman ciphers in 2015 and beyond
If you're using ECDHE, you might consider DHE as well, in case the user has disabled ECDHE at their end because they don't trust it. It's true that very nearly all users will end up using ECDHE rather than DHE if both are available.
Aug
25
answered Usage of Ephemeral Diffie-Hellman ciphers in 2015 and beyond
Aug
15
comment Is there any meaning in only allowing port 80 and 443 today?
@MartinSchröder Encrypted traffic can still be proxied; encryption just prevents the proxy from sniffing the traffic en route.
Aug
3
comment Preventing installation of VPN software on home computers?
Prevented by whom, and for what purpose?
Jul
28
awarded  Good Answer
Jul
26
comment Random characters and letters form obsfuscation
How will you know that your "random" numbers and letters are really random? Javascript's Math.random() function only generates pseudo-random numbers, and their randomness (or lack of it) is implementation-specific and cannot be trusted.
Jul
24
comment What prevents a man in the middle from requesting a certificate for your server?
You should be able to create a DNS record or a new web page in a few minutes. If you can't, then that's your problem, and you won't get your certificate in a few minutes.
Jul
24
comment What prevents a man in the middle from requesting a certificate for your server?
@IlyaChernomordik The certificate providers check that you own the domain for which you want a certificate. They don't check whether it's a typo for another domain -- how could they? All domains are potentially typoes for other domains, and so if no certificate could be issued to a potential typo, then no certificates could be issued at all.
Jul
24
answered What prevents a man in the middle from requesting a certificate for your server?
Jul
24
answered Guessing the whole PBDKF2 output from 1 half
Jul
14
comment Is this RSA/AES combination good?
@AdrianSicaru The folks at StackExchange really need to add the ability to downvote comments, just so that we can downvote "We all are new to cryptography and creating our own crypto protocol seems like a good ideea". It's a really, really bad idea.
Jul
14
comment Electronic identity and digital signatures - why they are different?
You may want to carry your identifying key around with you, so that you can identify yourself when required, but keep your signing key at home where it's more secure, since the consequences of losing it are more serious. But if both keys are stored in the same card, I guess that wouldn't apply here.
Jul
7
comment Is it possible to use obtained wildcard certificate on more than one server?
Note that some certificate providers' contracts limit the number of servers on which the certificate can be used. It's a commercial limit not a technical limit, and the certificate will work, but you may be in breach of your contract. You need to read the small print.
Jul
7
comment How do I hide files inside an image without using any steganography tools?
Technically "cat" is a steganography tool here, because it's a tool that you're using for (very basic) steganography. So it's not actually a valid answer to the question (which is indeed unanswerable).
Jul
5
comment What countries have strong data protection laws?
The question was about data protection laws, not data retention laws.
Jul
1
awarded  Nice Answer
Jul
1
answered Is it neccessary that website certificate must have site URL?
Jun
9
answered Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server