Rohit Gurunath

security software engineer @microsoft

[Rohit Gurunath @rohitg5249]

A MAC is not a Hash; this confusion caused an interesting bug in AMD. Shoutout to @_MatteoRizzo for the excellent find last year. I’ve been wanting to write this for a while; my analysis of the interesting cryptography concepts - https://t.co/Gk7e5CYNhv

[Rohit Gurunath @rohitg5249]

@dinodaizovi This is a very good idea to keep secrets out of agent sandboxes; although it implies the proxy likely has to be able to intercept and decrypt TLS, making it a single point of failure!

[Rohit Gurunath @rohitg5249]

@The_Weatherman2 @The_Weatherman2 what’s a good source you’d recommend for monitoring AQI ? I see conflicting data for different parts of puget sound!

[Rohit Gurunath @rohitg5249]

@SusanPolgar Black queen to f5 , white move rook / bishop to e4, black knight to f4, white pawn take out black knight at f4, black queen to h3, white rook to e3 , take out using black pawn … check-mate in a few moves!

[Rohit Gurunath @rohitg5249]

@anirudhology @system_monarch @anirudhology good blog post - this is one of the most pragmatic answers I’ve seen. Aside from this, dPOP is another way of making a stolen token useless, but it’s a newer protocol that must be explicitly implemented https://t.co/U9YXeKXeQh

[Rohit Gurunath @rohitg5249]

side-channel security matters for cryptography implementations: https://t.co/DxME1qj5dy

[Rohit Gurunath @rohitg5249]

@penberg @mgill25 I’ve used ocaml to build a compiler - this was for a university project; I hated it initially but towards the end understood some of its strengths especially wrt pattern matching etc Shameless plug - https://t.co/QXSbPstdgu

[Microsoft Security Response Center @msftsecresponse]

Day 2 of #ZeroDayQuest brought together brilliant minds from around the world for more hands-on hacking and meaningful community connections. Catch the energy in our recap video!

@secbughunter @tinderj_ @ZenOneSec @0xdea

[Rohit Gurunath @rohitg5249]

@karpathy @karpathy good summary. I’d also add passkeys (which further protect against phishing) as a replacement for passwords where!

[Rohit Gurunath @rohitg5249]

@_MatteoRizzo @_MatteoRizzo good reminder that A Mac is not a collision resistant hash function! Really cool find and write up btw.

[Rohit Gurunath @rohitg5249]

I’m hiring security engineers for my team at Microsoft to help secure the Azure cloud. Looking for senior security engineers with experience in AppSec/Security Architecture/OS security/web security!

DM for any questions!

Interested? : https://t.co/VnF3nf940m

[Rohit Gurunath @rohitg5249]

@deedydas I think reverse BFS would work. Probably easy to code during an interview as well!

[Rohit Gurunath @rohitg5249]

@mohol_murlidhar @RamMNK OTP verification renders the service unusable for those that need it. Most airports across the world provide free WiFi without requiring an OTP/ mobile verification. I implore you to consider this to improve customer experience across airports in India.

[Rohit Gurunath @rohitg5249]

@AAI_Official @MoCA_GoI why do airports in India require OTP verification before accessing airport WiFi? Travelers that actually need WiFi are unlikely to have an Indian phone no. Those with an Indian phone no most probably have mobile data and don’t need WiFi.

[Rohit Gurunath @rohitg5249]

@AravSrinivas A sandbox that’s as good if not better!

[Rohit Gurunath @rohitg5249]

New blog : exploring interpolation and shamir’s secret sharing

https://t.co/SYK2Mn2PHn

[Rohit Gurunath @rohitg5249]

I only had a few hours to spare due to personal commitments but nevertheless enjoyed participating in Htb2024
@hackthebox_eu

https://t.co/He0eAKhaVd

[Rohit Gurunath @rohitg5249]

@nstfkc If using redis for sessions, I presume the redis cache must be shared across your web servers, no ? (Else how would sessions work across servers?) To prevent a bad client from forcing db/redis lookup with bad sessionIds maybe JWT validate first and then lookup redis ? Thoughts?

[Rohit Gurunath @rohitg5249]

@dinodaizovi Nice idea to use additional authenticated data to bind extra context. @dinodaizovi I *think* even if some columns cannot be encrypted, the same idea could be extended via (say) hmac to mitigate injections? Would love to read a blog post if available!

[Rohit Gurunath @rohitg5249]

@priynshuratnakr Very surprised to see no questions being asked about the security / privacy implications of this app being able to read sms, urls etc. seems contradictory to the original claims about e-commerce data collections.