7,236 reputation
11443
bio website
location
age
visits member for 3 years, 6 months
seen Dec 21 at 5:16

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Sep
12
comment Is there a pre-existing taxonomy of attackers?
the NSA doesn't have an interest in you, they did try, but its just not working out
Sep
12
comment Did US and UK spy agencies defeat privacy and security on the internet?
The prefered M.O. for covert action is targeted, i.e. a few people rather than whole group. BlueCoat is unnoticed in environments where the end point trusts a enterprise cert and the intercepting proxy is signed by the enterprise cert
Sep
6
answered Did US and UK spy agencies defeat privacy and security on the internet?
Sep
6
answered If we can no longer trust NIST, what are viable alternatives?
Sep
5
awarded  Taxonomist
Sep
4
answered Trust Issues Relative to Open Source
Sep
4
comment Is it possible to find who posted comment on my blogspot anonymously?
In many cases it is possible to find who posted a comment, but it is rarely worth the effort.
Aug
29
comment Incentives to Support Adoption of the Cybersecurity Framework
"a Federal legal privilege that preempts State disclosure requirements." Civil War 2? East versus West
Aug
21
reviewed No Action Needed XSS Penetration Tools for OSX
Aug
21
reviewed Leave Open What are the security implications of the POLi Internet Payments technique?
Aug
21
comment What are the security implications of the POLi Internet Payments technique?
Welcome to IT Security. If you could limit your question to one specific aspect of security I think you will receive a better response. Perhaps a question about the implications for fraud.
Aug
20
answered Who tells that TrueCrypt is secure?
Aug
20
comment Risks of Mullions in High Security Areas
Don't your doors and walls have stuff in them? I would hope a secure door is not hollow. Are the walls hollow? What is the address again?
Aug
13
comment Risks of Mullions in High Security Areas
I would be most concerned about someone drilling through the apparently hollow mullion just to do reconnaissance on the assets inside. Sometimes knowing what is inside is all an adversary needs.
Aug
12
comment Is Windows BitLocker secure?
If the machine is off, there are no non-physical attacks that are effective. Network based attacks require a machine to be available on a network.
Aug
12
comment Secure alternative to e-mail
Security must be defined in terms of Confidentiality, Integrity, and Availability. E-mail is a method of textual communication which make transit across a public network of networks. Do you wish confidentiality of sender identity, integrity of message, restriction of access of message content to a specified recipient? Confidentiality of recipient is beyond technical application under the current concept of e-mail.
Jul
23
awarded  Nice Answer
Jun
18
revised FOUO on hosted sharepoint
added 189 characters in body
Jun
18
answered FOUO on hosted sharepoint
Jun
16
answered What security settings are likely used in Obama's Blackberry?