504 reputation
111
bio website
location
age
visits member for 1 year, 9 months
seen Jun 20 '13 at 23:50

Inside the Twisted Mind of the Security Professional Bruce Schneier:

Security requires a particular mindset. Security professionals -- at least the good ones -- see the world differently. They can't walk into a store without noticing how they might shoplift. They can't use a computer without wondering about the security vulnerabilities. They can't vote without trying to figure out how to vote twice. They just can't help it.


Sep
27
awarded  Popular Question
Jun
28
awarded  Yearling
Apr
24
awarded  Popular Question
Mar
22
comment Why is NIST removing & not updating TLS guidance? What is the replacement?
Under "Archived Special Publications" csrc.nist.gov/publications/PubsSPArch.html Sp800-52 is the only document that has no "Superceded By:". I doubt there is an automatic cut-off.
Mar
22
asked If an ATM is stolen, how easy can the personal information of the users be recovered?
Mar
22
asked Why is NIST removing & not updating TLS guidance? What is the replacement?
Feb
28
comment What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Commonly one can select the TLS version allowed but this seems to be insufficient if the server is using certificates that include weak keys (for example 512-bit RSA or short DH public key). The cipher suite seems to indicate the algorithm and size for the bulk-encryption algorithm but for the key-exchange only the algorithm is indicated - DHE_RSA or DH-RSA, etc
Feb
28
asked What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Jan
31
accepted Salted hashes vs HMAC?
Jan
30
comment Are banks required to be PCI compliant?
Are the controls you mention standardized or at the whim of individual bank?
Jan
30
asked Salted hashes vs HMAC?
Jan
30
comment What security standards and regulations are in place for bank ATM?
Are you saying that banks have to be PCI compliant?
Jan
30
asked Are banks required to be PCI compliant?
Jan
30
comment What security standards and regulations are in place for bank ATM?
I see ATMs in the most obscure places - convenience stores, bars, motel hallways, to name a few. I seriously doubt many have separate LAN segments or much in terms of secure infrastructure. Are merchants not required to establish minimum baselines for protection of communication?
Jan
29
asked What security standards and regulations are in place for bank ATM?
Jan
9
accepted Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?
Jan
9
comment Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?
SP800-132 suggests a minimum iteration count of 1,000, therefore if Blackberry is using anything less than the recommended value I would say that they are not in compliance with the standard.
Dec
20
asked If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?
Dec
20
revised Are we concentrating too much on password complexity?
added 389 characters in body
Dec
20
comment Are we concentrating too much on password complexity?
Hash cracking becomes an issue IF the database is compromised, and only if the database uses a storage method for the password that is not exponentially impossible to reverse. So if we mitigate this risk at the back end, why alienate the user with complex password requirements?