7,236 reputation
11443
bio website
location
age
visits member for 3 years, 6 months
seen Dec 21 at 5:16

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


May
31
reviewed Leave Open Way to make “DNS unblockers” safe?
May
31
comment Can someone please briefly explain HIPPA compliance?
Ask your legal team: What do I need to do, so I don't go to jail?
May
31
answered Are there HIPAA requirements to encrypt our database hosted in AWS
May
31
comment Why is it considered safe for services like Mint to store bank password?
I wish more people understood the basic concept of risk. Nicely put, you can never have zero risk, just more or less.
May
31
comment Why is it considered safe for services like Mint to store bank password?
please read more broadly security.stackexchange.com/questions/10820/…
May
31
comment Should statically-linked server binaries (daemons) be deemed more secure?
You need to provide a measure or goal for "less prone" to attack vectors. By number of attacks, type, severity, consequence, remediation cost, etc.
May
31
answered Snowden: “The NSA can remotely turn on your iPhone.”
May
31
awarded  Custodian
May
31
reviewed Approve If a Windows laptop with an encrypted hard disk is stolen, can the contents be accessed by a professional hacker?
May
21
comment Deleting a Java Object securely
@jbyler From Java Cryptography Architecture (JCA) "The KeyStore class supplies well-defined interfaces to access and modify the information in a keystore." The exact protection depends on the Java implementation: Oracle/Sun, Android, or other.
May
21
comment What chars should I not allow in passwords?
@Luc for password in {{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..‌​Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}; do echo -n $password | md5sum>>rainbow; echo $password >>rainbow; done; echo "8-character letter-only rainbow tables for md5, simply grep for md5 and get password, no gpu required"
Apr
16
awarded  Nice Answer
Mar
25
awarded  Necromancer
Feb
4
answered Encrypting user details
Jan
17
answered Android and FIPS
Jan
17
reviewed Close Snort alert log simple question
Jan
3
reviewed Close I don't understand how BIPS got hacked
Dec
9
awarded  Nice Answer
Oct
13
awarded  Nice Answer
Oct
3
comment Could mint.com be more secure, and if so, how?
Law is the easiest remedy. Make online service providers liable for the full amount of any loss incured by an individual and due within seven days of the loss event. To align security interests, align the financial interests.