7,072 reputation
11440
bio website
location
age
visits member for 3 years, 2 months
seen 11 hours ago

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


May
21
comment What chars should I not allow in passwords?
@Luc for password in {{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..‌​Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}; do echo -n $password | md5sum>>rainbow; echo $password >>rainbow; done; echo "8-character letter-only rainbow tables for md5, simply grep for md5 and get password, no gpu required"
Apr
16
awarded  Nice Answer
Mar
25
awarded  Necromancer
Feb
4
answered Encrypting user details
Jan
17
answered Android and FIPS
Jan
17
reviewed Close Snort alert log simple question
Jan
3
reviewed Close I don't understand how BIPS got hacked
Dec
9
awarded  Nice Answer
Oct
13
awarded  Nice Answer
Oct
3
comment Could mint.com be more secure, and if so, how?
Law is the easiest remedy. Make online service providers liable for the full amount of any loss incured by an individual and due within seven days of the loss event. To align security interests, align the financial interests.
Sep
12
comment Is there a pre-existing taxonomy of attackers?
the NSA doesn't have an interest in you, they did try, but its just not working out
Sep
12
comment Did US and UK spy agencies defeat privacy and security on the internet?
The prefered M.O. for covert action is targeted, i.e. a few people rather than whole group. BlueCoat is unnoticed in environments where the end point trusts a enterprise cert and the intercepting proxy is signed by the enterprise cert
Sep
6
answered Did US and UK spy agencies defeat privacy and security on the internet?
Sep
6
answered If we can no longer trust NIST, what are viable alternatives?
Sep
5
awarded  Taxonomist
Sep
4
answered Trust Issues Relative to Open Source
Sep
4
comment Is it possible to find who posted comment on my blogspot anonymously?
In many cases it is possible to find who posted a comment, but it is rarely worth the effort.
Aug
29
comment Incentives to Support Adoption of the Cybersecurity Framework
"a Federal legal privilege that preempts State disclosure requirements." Civil War 2? East versus West
Aug
21
reviewed No Action Needed XSS Penetration Tools for OSX
Aug
21
reviewed Leave Open What are the security implications of the POLi Internet Payments technique?