Research (By Popularity)

A list of research pages, sorted by upvotes and downvotes. Please upvote the pages you like and downvote the ones you don't.

1544
Timing Side Channel Port Scanner in the Browser
How web pages can use a timing side channel to "scan" your local network.
1250
EncFS Security Audit
The results of an EncFS security audit.
700
How do we model this robot?
The difference between Computational Ability and Informational Ability
618
Blind Birthday Attack
A birthday attack without knowing what the collision actually is.
606
Encryption - CBC Mode IV: Secret or Not?
Should the IV in CBC mode be kept secret?
491
TrueCrypt's Plausible Deniability is Theoretically Useless
Why you really ought to have a hidden volume, even if you don't need one.
474
Is Security Local?
Is security a locally-verifiable property of computation?
471
Encrypting One Time Passwords (EOTP)
EOTP is a cryptographic One Time Password (OTP) protocol designed to provide a static encryption key across login sessions.
438
eCryptfs Security Audit
The results of an eCryptfs security audit.
429
The PUP Confusion Technique
Undetecting malware by making it look like a Potentially Unwanted Program (PUP).
419
ZeroBin Security Audit
A security audit of the ZeroBin pastebin.
411
Asus G Series Keyboard Design Error
Fixing a problem with the keyboard in an ASUS laptop.
361
Practical Race Condition Vulnerabilities in Web Applications
An example of a web application (PHP) vulnerable to a race condition, and how to fix it.
355
Web Browser Cryptography is a Good Thing
Why we should support the development of browser-based crypto applications.
284
Exploiting C++ VTABLES: Instance Replacement
Use a memory corruption vulnerability to change an instance of class A into an instance of class B.
276
FLUSH+RELOAD: Multi-User Systems are Doomed
The FLUSH+RELOAD side-channel attack breaks the security of multi-user systems.
263
Data Flow in Web Applications
A look at the flow of data in web applications and how it can be tamed for security.
258
Cracking Synergy's Bad Cryptography
A tool to crack Synergy's homebrew cryptography.
243
Triangle of Secure Code Delivery
Three properties necessary and sufficient for delivering code safely.
237
Password Hashing After the PHC
Giving authenticators an advantage over password crackers with cache.
213
Centralization is Killing Bitcoin
An article on Bitcoin, centralization, and DDoS attacks.
169
Bochs Hacking Guide
Hacking the Bochs x86 CPU emulator.
124
Hash0 Security Audit
A security audit of the Hash0 pastebin.
115
Mitigating BREACH in PHP
PHP code for mitigating the BREACH attack.
113
A Manual Random Number Generator
Generating random numbers with paper coins.
85
PEFS Security Audit
Security audit of the Private Encrypted File System (PEFS).
51
Confirmed: Microsoft Visits Links You Send In Skype
I sent a link through Skype and Microsoft visted it, confirming The H's claims.
34
Gocryptfs Security Audit
A security audit of the gocryptfs encrypted filesystem.
29
Concentration Bounds from Parallel Repetition Theorems
My master's thesis, showing how concentration bounds can be derived from parallel repetition theorems for nonlocal games and interactive proofs.
15
A Simple Proof of Gödel's Second Incompleteness Theorem Using Turing Machines
Proving Gödel's second incompleteness theorem in a way that should be understandable to anyone who understands the proof that the halting problem is undecidable.
6
A Plausible Reason It's So Hard To Prove P!=NP
Attempting to show why P!=NP is hard to prove using hash functions.
5
Negative Feedback for Insecure Connections
Should web browser interfaces provide negative feedback when the connection is insecure?
2
Instruction Filters as an Exploitation Defense
Disabling CPU instructions to thwart ROP and other attacks.
1
Security Engineering from Safety-Critical Disciplines
Useful concepts and methods from safety engineering, applied to computer security.
1
Auditician: Automated Security Audits with Claude Code
Claude Code agents and audit process descriptions for performing security audits automatically.
-8
Side-Channel Attacks on Everyday Applications
My Black Hat USA 2016 talk about the Flush+Reload side channel.
-14
File System Events Leak Folder Contents
An information disclosure vulnerability in Windows shared folders that lets you see what's in folers you can't access.