52,562 reputation
379214
bio website
location
age
visits member for 3 years, 3 months
seen 5 hours ago

15h
comment Client-server authentication protocol suggestion
"I know that I could just use SSL, but I would like to (for some reasons)" - What does that mean? Did you leave out some words? What would you like to? And what are the reasons? The first question a security professional is probably going to ask is: why not just use SSL? I encourage you to edit the question to make this clearer, if you'd like to get useful responses.
15h
comment Preventing deauthentication attacks
@DanEsparza, you might be right. I had the impression clients would automatically re-connect, but I could be wrong: I haven't tested it. If you found documentation that says it kicks clients off the network and they staff off, I believe you.
Apr
16
comment What happens if biometric data is stolen?
In addition, we expect people to do serious research on their own before asking, and to show us what they've done. There's a lot that has been written on this subject; you should try doing some searching on this topic before asking. For instance, have you tried Bruce Schneier's blog and books? Have you read through Wikipedia? Have you read standard introductions to biometrics, e.g., in Ross Anderson's Security Engineering book?
Apr
15
awarded  Popular Question
Apr
12
awarded  Nice Question
Apr
9
revised Guidance for implementors of HTTPS-only sites (Server side)
added 312 characters in body
Apr
9
comment Guidance for implementors of HTTPS-only sites (Server side)
@JustinCloud, you are right. There's nothing wrong with loading images from third-party sites (if they are loaded over HTTPS). I will edit my answer accordingly -- thank you for catching that!
Apr
5
awarded  Announcer
Apr
4
awarded  Nice Question
Apr
2
comment Is there any advantage to splitting a password?
Thanks, @Anti-weakpasswords! Good point. I've revised my answer accordingly. I appreciate the feedback.
Apr
2
revised Is there any advantage to splitting a password?
Incorporate comment from Anti-weakpasswords.
Mar
26
awarded  Good Answer
Mar
21
asked Exploitability of use-after-free vulnerabilities
Mar
21
revised ROP resistant gadgetless binaries
added 185 characters in body
Mar
21
answered ROP resistant gadgetless binaries
Mar
20
awarded  Necromancer
Mar
19
comment Prevent denial of service attacks against slow hashing functions?
@Pacerier, 1) Usually they don't use their own IP addresses. They use an anonymizer, or a proxy, or route through a compromised machine, or use Tor, or some combination of the above. 2) The forums may be hosted overseas, so it's typically not entirely trivial for law enforcement to get the IP addresses of people posting to those forums. We're now getting quite far afield from the question. This is not a discussion forum, so I'm not going to continue any further discussion of this topic here. For more about why it is hard to prosecute criminals, try searching, or ask a separate question.
Mar
17
comment Prevent denial of service attacks against slow hashing functions?
@Pacerier, yes. The purpose of a client puzzle is to increase the cost of a denial-of-service attack. So, it's not a black-and-white situation; it's a matter of how much we can increase the cost to an attacker. Here the cost to an attacker is based upon the amount of computation power the attacker must mount. If the attacker has to do 5ms of computation per request, that limits the attacker to at most 200 requests per second per bot, which might be a step forward compared to the situation if there is no client puzzle. Is it enough? That'll depend, but it might be better than nothing.
Mar
17
awarded  Notable Question
Mar
17
awarded  Announcer