Reputation
63,043
Next tag badge:
99/100 score
23/20 answers
Badges
8 125 323
Newest
 Nice Answer
Impact
~3.2m people reached

20h
comment Why is being able to login with capslock bad?
Is it case-insensitive, or case-swapping? If your password is "happy", does it accept "happy" and "HAPPY" and "HaPpY" or just "happy" and "HAPPY"? If your password is "happiNESS", what does it accept? See also security.stackexchange.com/q/68013/971 and security.stackexchange.com/q/14816/971.
22h
comment How secure can IP based login be?
@machineyearning, well, that's a detail that doesn't really affect my point and is tangential, so if you really want to know, you should ask a separate question. The short answer is that in practice, it's probably more like 2^32 than 2^31. It's not that there is a single ISN which we get to repeatedly guess until we get it right. Instead, we try to open multiple connections, each with its own ISN, which we can guess. In the latter situation the number of guesses needed to have a 50% chance of guessing right is closer to 2^32 than 2^31.
1d
awarded  Nice Answer
1d
revised New denial-of-service vulnerability in TLS protocol, based on shooting down other users' sessions?
deleted 22 characters in body
1d
revised New denial-of-service vulnerability in TLS protocol, based on shooting down other users' sessions?
Add tags. Improve language significantly.
1d
answered New denial-of-service vulnerability in TLS protocol, based on shooting down other users' sessions?
1d
comment Is sha1sum still secure for downloadable software packages signature?
Your question is too a question about SHA1 -- I have no idea why you would think it isn't. Asking whether sha1sum is secure amounts to asking whether the SHA1 algorithm is secure, as sha1sum just computes the SHA1 algorithm.
2d
comment Is sha1sum still secure for downloadable software packages signature?
Use it for what purpose? What research have you done? Have you read en.wikipedia.org/wiki/SHA-1 and security.stackexchange.com/q/64049/971? It has discussion on the known weaknesses in SHA-1 and attacks on it and on the different types of security goals that applications might need. What specifically is your confusion, that isn't already covered by that Wikipedia article and other articles here on this site? See also security.stackexchange.com/q/94690/971 and sha.
Sep
2
awarded  Popular Question
Sep
1
comment CV to a Suspicious Professor
We can't tell you whether the information on your CVs is an identity theft risk if you don't tell us what information is on your CVs -- but that said, schroeder's comment is likely to cover it, given what tends to occur on most CVs I've seen.
Sep
1
awarded  Notable Question
Aug
31
comment Are all SSL/TLS implementations vulnerable to the Heartbleed bug?
Have you read through the other questions in the heartbleed tag? Your questions seem to be answered by others there. In particular, this looks like a possible dup of security.stackexchange.com/q/55116/971; possibly also security.stackexchange.com/q/55217/971 and/or security.stackexchange.com/q/55249/971. Also you should read security.stackexchange.com/q/55343/971.
Aug
31
comment Are all SSL/TLS implementations vulnerable to the Heartbleed bug?
I can't tell what exactly you're asking. The question asked in the title is very different from the question in the body. What does it mean to "use the same underlying theory of SSL and TLS"? What research have you done? What do you mean "degree of promise toward SSL/TLS"? I suggest editing the question to elaborate on what problem you are trying to solve, what research you have done, what your current thoughts are, and what specifically you are confused about.
Aug
30
comment What is the difference between http and https with a self-signed SSL certificate?
See also security.stackexchange.com/q/97247/971.
Aug
30
comment XSS TRACE method
Please edit your question to (1) provide a more descriptive title, (2) tell us what research you've done (hint: there are other questions on this site that seem relevant).
Aug
27
answered Cloudflare's free SSL options require trusting them; what could they do to change that?
Aug
27
awarded  Popular Question
Aug
26
revised Can simply decompressing a JPEG image trigger an exploit?
edited tags
Aug
25
answered Fuzzing shared libraries
Aug
20
awarded  Nice Answer