7,474 reputation
21743
bio website
location
age
visits member for 4 years, 1 month
seen Jun 27 at 0:43

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Jun
19
revised Online anonymity for a journalist in a dangerous country
added 720 characters in body
Jun
19
answered Online anonymity for a journalist in a dangerous country
Jun
19
revised Online anonymity for a journalist in a dangerous country
Focused on the identity concern instead of the technical measures
Jun
4
awarded  Yearling
May
26
awarded  Necromancer
May
5
awarded  Generalist
Apr
9
awarded  Electorate
Apr
9
comment Steganography to hide text within text
@mulllhausen Attaching photos and graphics to e-mail is nearly ubiquitous. The larger the ratio of carrier data to secret data the easier it is to hide the secret data. Consider a small secret message of 20 characters. Hiding it in a message of 1200 characters gives you a ratio of 1200 to 20 or 60:1. Consider hiding the same 20 characters in a small jpeg image of 20kb. This time the ratio is 1000:1. Even HTML is a significant improvement over plain text because you can hide information in the formatting.
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
Read security.stackexchange.com/questions/5769/… and security.stackexchange.com/questions/67819/… for reference. Are you mixing content type for plausable deniability?
Apr
9
comment Steganography to hide text within text
Are you using text because of transmission channel restrictions or you think it would look more innocent to a third party?
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
You need to verify the contents or just that the content integrity is unchanged since it was created? Are data segments going to be split and remixed?
Apr
9
comment What's a term to describe multiple shoulder surfing attacks to uncover different parts of the password?
Advanced Shoulder Surfing with Half Observable Length Enumeration
Apr
8
comment How prevent online payment fraud?
Do authorization and settling take place over separate channels? Is authorization made for an amount or just for a transaction? We need some details otherwise this reduces to the "Two Generals Paradox" which is unsolvable.
Apr
8
comment How prevent online payment fraud?
Who are the actor here? Please explain the green and red connections. Is the Bank a payment processor?
Apr
8
reviewed Leave Open How can you use XSS to break this security on a site?
Apr
8
reviewed Close Determine Security Of A PDF File
Apr
8
reviewed Close How is it possible for threatmetrix to detect VPN?
Apr
7
comment Mars Curiosity Rover Security
As a US Government agency, NASA would fall under the supervision of the NSA. I believe the Red Black categorization originates from the NSA and is repeated by other agencies that must have their certification for operation of sensitive resource
Apr
7
reviewed Close iOS permissions for 3rd party app developers
Apr
7
reviewed Close Why companies do not simply use hackers' tools to find their own vulnerabilities prior to the release of their software?