Drew Lex

479 reputation

bio	website
	location
	age
visits	member for	10 months
	seen	Apr 2 at 13:35
stats	profile views	54

Inside the Twisted Mind of the Security Professional Bruce Schneier:

Security requires a particular mindset. Security professionals -- at least the good ones -- see the world differently. They can't walk into a store without noticing how they might shoplift. They can't use a computer without wondering about the security vulnerabilities. They can't vote without trying to figure out how to vote twice. They just can't help it.

	479 reputation	bio	website		visits	member for	10 months
10 badges		location			seen	Apr 2 at 13:35

summary answers questions tags badges favorites bounties reputation activity

84 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 24	awarded	Popular Question
Mar 22	comment	Why is NIST removing & not updating TLS guidance? What is the replacement? Under "Archived Special Publications" csrc.nist.gov/publications/PubsSPArch.html Sp800-52 is the only document that has no "Superceded By:". I doubt there is an automatic cut-off.
Mar 22	asked	If an ATM is stolen, how easy can the personal information of the users be recovered?
Mar 22	asked	Why is NIST removing & not updating TLS guidance? What is the replacement?
Feb 28	comment	What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed? Commonly one can select the TLS version allowed but this seems to be insufficient if the server is using certificates that include weak keys (for example 512-bit RSA or short DH public key). The cipher suite seems to indicate the algorithm and size for the bulk-encryption algorithm but for the key-exchange only the algorithm is indicated - DHE_RSA or DH-RSA, etc
Feb 28	asked	What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?
Jan 31	accepted	Salted hashes vs HMAC?
Jan 30	comment	Are banks required to be PCI compliant? Are the controls you mention standardized or at the whim of individual bank?
Jan 30	asked	Salted hashes vs HMAC?
Jan 30	comment	What security standards and regulations are in place for bank ATM? Are you saying that banks have to be PCI compliant?
Jan 30	asked	Are banks required to be PCI compliant?
Jan 30	comment	What security standards and regulations are in place for bank ATM? I see ATMs in the most obscure places - convenience stores, bars, motel hallways, to name a few. I seriously doubt many have separate LAN segments or much in terms of secure infrastructure. Are merchants not required to establish minimum baselines for protection of communication?
Jan 29	asked	What security standards and regulations are in place for bank ATM?
Jan 9	accepted	Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?
Jan 9	comment	Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132? SP800-132 suggests a minimum iteration count of 1,000, therefore if Blackberry is using anything less than the recommended value I would say that they are not in compliance with the standard.
Dec 20	asked	If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?
Dec 20	revised	Are we concentrating too much on password complexity? added 389 characters in body
Dec 20	comment	Are we concentrating too much on password complexity? Hash cracking becomes an issue IF the database is compromised, and only if the database uses a storage method for the password that is not exponentially impossible to reverse. So if we mitigate this risk at the back end, why alienate the user with complex password requirements?
Dec 20	comment	Are mail-servers removed from security concerns in contrast with cloud storage? For a business that collects data via email that travels through out-of-house mail servers, I'm arguing that rejecting other cloud services due security risks is somehow irrational since the data has already been or currently is minimally protected (e.g. copies of the files received by email lay on a IMAP server).
Dec 20	comment	Are we concentrating too much on password complexity? I am not arguing that we should not strive for up-most security, I'm just wondering if the efforts are misdirected at forcing the user to select a complex password even when the the back end is secure (good physical and logical security, database encrypted, password salted and properly hashed). If the system only allows an attacker to guess the user password at a very slow rate (maybe an exponential wait between failed attempts) or by using a two-factor authentication, aren't complex password requirements superfluous?