221 reputation
12
bio website
location Germany
age
visits member for 2 years
seen Mar 29 at 8:25

Jan
24
comment Why EMV cards cannot be cloned?
@SoftwareMonkey It is good practice for a designer to assume the attacker knows the algorithms (and pick well-analyzed cryptographic algorithms and protocols) plus the communication protocol. That does not imply they actually are published, so as an attacker, you may still need to figure them out, in addition to the key itself.
Jan
4
comment Authencity of information displayed on an untrusted device
If your trusted device can read exactly what you read (OCR A?), it could just have a single LED for “signature verification successful”. But that is only useful for fixed-format messages where you can be certain the device reads exactly what you think it reads and does not, e.g., skip characters which you didn’t realize where unreadable to the device.
Jan
3
answered Authencity of information displayed on an untrusted device
Apr
10
awarded  Yearling
May
12
comment Security of GPG encryption with AES and MD5 if MD5 is broken
What is the hash use for? Signing?
May
12
answered SSH : Remote Host Identification Changed
May
11
awarded  Teacher
May
11
comment gpg encryption security
The weak point will always be the password, and both use good standard algorithms, so yes, in terms of security, if everything is set up to work transparently and we only look at the off-site backups, they are equivalent. Obviously, the more convenient solution wins then, and TrueCrypt has additional protection in case your hardware is stolen. On the other hand, afaik, it doesn't encrypt individual files, meaning you can't (mis-)use your Mailbox as outlined in your question.
May
11
answered gpg encryption security
Apr
14
awarded  Supporter
Apr
14
comment Found huge bug, what should I do?
I'd guess that in most countries, it would be a very bad idea to either exploit such a bug or threaten to. Of course, there might be companies where you can get a “consulting fee” under such circumstances and it seems there is also a black market for this kind of information, but as with any black market, I personally would stay away from that; most people would consider just sending a (complimentary) description to the IT department the morally right thing to do – and if they don't fix it in half a year, send the description on bugtraq.
Apr
10
comment Why can an encrypted private key be brute forced?
@Paŭlo Ebermann: You would normally have p, q, and 1/q mod p in your private key, because that allows to use the Chinese remainder theorem to speed up the computations.