tylerl

11,671 reputation

11441

bio	website	tltech.com
	location	United States
	age	34
visits	member for	2 years, 1 month
	seen	3 hours ago
stats	profile views	303

I work for TL Tech solving problems like the ones you see on this site. If you're stuck and you just want someone to fix it for you, give me a call.

Contact Me

	11,671 reputation	bio	website	tltech.com	visits	member for	2 years, 1 month
11441 badges		location	United States		seen	3 hours ago

summary answers questions tags badges favorites bounties reputation activity

627 Actions

suggestions reviews revisions comments badges posts accepts all

3h	answered	Why did Apple think OS/X was virus proof?
12h	revised	Any obvious flaws in this protocol? added 137 characters in body
22h	comment	Why does PGP use symmetric encryption and RSA? This must be a duplicate several times over.
22h	answered	Any obvious flaws in this protocol?
22h	answered	NFC used in place of contact based smart card two-factor authentication
23h	comment	Any obvious flaws in this protocol? Is this UDP or TCP?
1d	answered	RSA key length vs. Shor's algorithm
1d	answered	How to fuzz proprietary protocol over SSL?
2d	comment	Are there low-tech ways to reliably generate passwords? Either you need to run it exclusively in your head or you don't. If you aren't going to have a computer near by to help you derive your password, then you're back to all in your head... so we're back to my first comment where I suggested that such a scheme was not adequately securable.
2d	comment	Recommended authenticated stream cipher for minimum overhead? Why oh why are you not using SSL, Dave? The protocol has been heavily vetted, tested, and protected against all sorts of vulnerabilities that you in your wildest dreams would never have even considered. If you're directly using AES, you're doing it wrong. No really, you actually are doing it wrong.
2d	comment	Are there low-tech ways to reliably generate passwords? ok then, generate crappy site-specific passwords, concatenate a personal secret phrase, and then SHA1->base64 the result. Take the first X characters according to site requirements, skipping characters not valid for that site. If symbols required are not present in your output, use a pre-determined substitution scheme to add them. As long as the scheme is deterministic, you'll be able to repeat the process to regenerate the password when you need it.
2d	comment	Are there low-tech ways to reliably generate passwords? do not like. Any system you can run in your head to repeatably generate memorable passwords for arbitrary inputs is going to follow patterns -- because that's how brains work. Which means someone in possession of a sufficient number off passwords can reverse engineer your scheme and derive ALL your passwords. Instead, a secure way to store RANDOM passwords (e.g. in your phone) will yield results much more appropriate for consideration on this site.
Jun 16	comment	Can the U.S. goverment crack encryption? Here's some interesting details: RSA was not invented by the NSA, but the NSA later claimed to have independently created the same technology earlier (though they obviously never told anyone). RSA will be crackable by quantum computers when they exist. AES will not. No currently existing asymmetric encryption algorithms are safe against attacks from quantum computers, but they may be possible if we discover a better trap-door function.
Jun 16	comment	Can the U.S. goverment crack encryption? crap. almost had my answer posted.
Jun 12	comment	Healthcare Ex-Employer accusing Employee - Can Attorney request Access to PC for Forensics? This question is very specifically about laws, legal implications, and court proceedings. All of this is off-topic for this site.
Jun 11	answered	Generating session CSRF token based on SSL session ID
Jun 11	answered	Is it legal to find bugs on a website and report them to the website's owner?
Jun 11	comment	does switching to linux remove existing computer virus @symcbean thought of mentioning that, but I've always had difficulty getting malware to run under wine.
Jun 9	comment	HTTP Parameters Pollution attack Hi hd., and welcome to Security.SE. Remember that this site isn't a general help forum. You have to ask specific questions that are of value to IT security professionals. If your question contains the phrase "help me" that's a strong sign that you're asking a question that's specific to you alone. You may have a good question somewhere in there, but you didn't ask it. I'd recommend looking at the problem you're facing and coming up with a specific industry-specific question. The question as it is will certainly get closed.
Jun 9	comment	Does hashing a PRNG make it cryptographically secure? Note that hashing is only one of a whole list of ways in which you can remove bias from a random bit stream. See Dealing With Bias in the WP HRNG page.