221 reputation
12
bio website
location Germany
age
visits member for 2 years, 3 months
seen Jul 22 at 16:21

Jun
27
comment SSH : Remote Host Identification Changed
If you use a password, the server you log in to needs to be sent that password in a form that it can use to check against its /etc/shadow, in whatever form it hashes passwords for that file. Since the server (assuming a standard user account installation) does not know your password in clear text, it cannot ask for some uniquely hashed version in a challenge-response way; the protocol must send the password such that the sshd sees the clear text password. Not a problem usually: ssh can do without passwords, using public keys.
May
5
comment Does Skype compromise my system (beyond the scope of calls/chats)?
I seem to remember Skype actively punches holes in your firewall. Which of course is a bad thing in itself. (Note that I'm talking about the real firewall outside your desktop computer, not some utility within the local OS misusing the term.)
May
5
comment Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?
Please add a little more information on details. As it stands, this answer does not appear credible and does not point at any particular weakness in the protocols.
Jan
24
comment Why EMV cards cannot be cloned?
@SoftwareMonkey It is good practice for a designer to assume the attacker knows the algorithms (and pick well-analyzed cryptographic algorithms and protocols) plus the communication protocol. That does not imply they actually are published, so as an attacker, you may still need to figure them out, in addition to the key itself.
Jan
4
comment Authencity of information displayed on an untrusted device
If your trusted device can read exactly what you read (OCR A?), it could just have a single LED for “signature verification successful”. But that is only useful for fixed-format messages where you can be certain the device reads exactly what you think it reads and does not, e.g., skip characters which you didn’t realize where unreadable to the device.
Jan
3
answered Authencity of information displayed on an untrusted device
Apr
10
awarded  Yearling
May
12
comment Security of GPG encryption with AES and MD5 if MD5 is broken
What is the hash use for? Signing?
May
12
answered SSH : Remote Host Identification Changed
May
11
awarded  Teacher
May
11
comment gpg encryption security
The weak point will always be the password, and both use good standard algorithms, so yes, in terms of security, if everything is set up to work transparently and we only look at the off-site backups, they are equivalent. Obviously, the more convenient solution wins then, and TrueCrypt has additional protection in case your hardware is stolen. On the other hand, afaik, it doesn't encrypt individual files, meaning you can't (mis-)use your Mailbox as outlined in your question.
May
11
answered gpg encryption security
Apr
14
awarded  Supporter
Apr
14
comment Found huge bug, what should I do?
I'd guess that in most countries, it would be a very bad idea to either exploit such a bug or threaten to. Of course, there might be companies where you can get a “consulting fee” under such circumstances and it seems there is also a black market for this kind of information, but as with any black market, I personally would stay away from that; most people would consider just sending a (complimentary) description to the IT department the morally right thing to do – and if they don't fix it in half a year, send the description on bugtraq.
Apr
10
comment Why can an encrypted private key be brute forced?
@Paŭlo Ebermann: You would normally have p, q, and 1/q mod p in your private key, because that allows to use the Chinese remainder theorem to speed up the computations.