Alexander Fadeev
  • Member for 1 year, 9 months
  • Last seen this week
Should I be using ECDSA keys instead of RSA?
9 votes

To be complementary to other answers, just let me share a nice table taken from NIST SP 800-57: Basically, what you can see here is that you would need RSA 3072 bit vs ECDSA 256-383 bit to achieve ...

View answer
Is there no way to bypass certificate pinning without patching apps?
Accepted answer
8 votes

No, there is no way to bypass certificate pinning without application patching or using debugger (tracer). The reason is that, in simple words, certificate pinning is when a CA certificate is ...

View answer
Does the saying "physical access = game over" apply to smartphones, too?
8 votes

Let's suppose I have done the most I can to secure my phone on a software level (e.g. encrypted storage, restricted app permissions ... whatever you consider "maximally secure"). Is physical access ...

View answer
Threema: Are received messages exposed, when sender's private key gets compromised?
Accepted answer
5 votes

Question #1: With Bob's key and the traffic, could Eve now decrypt all content Bob has ever sent to Alice? Yes. It is about "forward secrecy" and it depends on how Threema manages session keys. (...

View answer
Is it feasible to recover a zip file password consisting of about 16 digits?
Accepted answer
4 votes

the password were chosen randomly, by randomly hitting keys TL;DR: Feasible to crack if the archive was protected with ZipCrypto, not feasible if the archive was protected with "WinZip" AES ...

View answer
Risks of Long-life Session
4 votes

Indeed the question is pretty interesting. Either way it boils down to a risk assessment plus controls in place of each system. Roughly, we could imagine 2 undesirable consequences of long-life ...

View answer
Can DeepCorr's correlation technique de-anonymize all Tor users?
Accepted answer
4 votes

Can DeepCorr's correlation technique de-anonymize all Tor users? No, it cannot de-anonymize ALL Tor users. (however it drastically narrows down the scope to proceed with successful de-anonymization) ...

View answer
Security implications of Cloudflare's SSL Full mode (not Strict)
3 votes

Issues with SSL Full (not strict) MITM: you can easily put the whole Internet into the scope, and at least your infrastructure provider. With SSL Full you have the following scheme in place: [user] --...

View answer
Is the Initial Public Key Transfer Process in Public Key Encryption Vulnerable to MITM on Public Networks?
1 votes

Yes. This is where PKI comes into play, where a trusted 3rd party (a trusted CA) ensures you: "yes, this is Mr. Smith/example.com, I personally issued a certificate to him, you can verify my ...

View answer
Security implications of using VM versus dual boot
1 votes

Virtual machine would be more secure and reliable option for you, because you would have an isolated environment (disk, memory, CPU, network, etc), you can start, stop, and remove it whenever you want....

View answer
A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?
0 votes

It's a bit difficult to speak about occasional string conversion in occasional points of a program: it's important to have a clear language specification with no undefined behavior. Undefined behavior ...

View answer
Certificates and keys validity
0 votes

Check the "Issuer" field of that "server certificate" of 2 years validitiy, it shows you whether certificate is signed with another one: intermediate certificate, and root certificate at the very top. ...

View answer
How does Algolia's virtual API keys work?
Accepted answer
0 votes

I think the trick here is that your application is referred to a small count of keys, therefore the server will quickly iterate over all keys, also server may store some cache of such computations, ...

View answer