hackhat

Imo the problem is of the issuer. They only opens holes by doing this kind of things. Imagine if you already secured the admin@domain.com and tomorrow the issuer thinks that admin-ssl@domain.com could be used for validation. Now what, you should keep up with their updates every hour?

I've said similar because of this, so your comment is included in my statement.

And code complete, clean code...

>Why would you do such a thing? My full explanation was in the content of the site. (edit: ...which is now gone)

So anyone really understood why he did this?

He also doesn't state that the output should be right at first decompression try. By using this you could encode multiple bits and then generate various wrong archives, knowing that after 1000000 tries he would get a correct decompressed file.

haha, yes, it's really full of surprises (: