markgamache
Re:AES on the iPhone is Broken by Default
on Wednesday December 14, 2011 @05:36PM (#3354023)
This article is 100% wrong. The IV is not a secret, must be know for decryption. In-fact counter mode simply picks a starting IV and increments. Allowing the attacker to manipulate the IV or reuse of an IV can be problematic, but a guessable IV is of NO HELP to an attacker
The Next Big Thing in Information Security
Re:Security researchers 'destroy' Microsoft ASP.NET security
on Friday September 17, 2010 @01:26PM (#1701972)
Totally irresponsible journalism. This is not all or .NET or even a tiny fraction. It is one control that will be rapidly patched.
This allows the end user to decrypt their own "encrypted" cookie, not an attacker. At best, if the web app writers were stupid and put truly exploitable data in the cookie, they'd be effected.
It is horrible that MS missed this, but calling .NET broken is probably actionable libel.
Some Things That IT Hates About Executives
How I Learned to Stop Hating Java and Start Loving s_client
Re:MyPasswordBuddy: An incredibly insecure password manager
on Friday February 12, 2010 @01:12AM (#1119906)
No SSL. Sign me up!
Ask HN: How do you use SSH?
http://www.surveymonkey.com/s/V7B88XX
I've seen SSH authentication done in many ways by different companies. I'm curious how the masses to SSH.Please take my survey! =)
Looking Inside the Citrix Netscaler and Client Access Gateway Ent SSL Payload
Crypto is easy, key management is hard. A guided example through a Fail.
Re:Sniffing the Unsniffable on Windows
on Tuesday August 04, 2009 @01:40PM (#741688)
AT no longer allows running as local system.
HTTPAnalyzer is great for HTTPS, but not pure SSL, such as LDAPS, in the example.