7,366 reputation
21443
bio website
location
age
visits member for 3 years, 10 months
seen 3 hours ago

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Jul
13
comment Data categorization: Critical or not
Who are the application users? What types of data is the application using? Are you classifying data just for the application or for the application, the operating system, the network stack, etc?
Jul
13
comment Why do malware creators use such clever technologies for such silly purposes?
I like the Developer/User argument. Just like the benign economy the users of software are often not the creators. There is some good reaserch on this malware economy. TrendMicro's "The Business of Cubercrime" is a very readable overview of this complex underground economy. Some highlights: affiliate programs, pay-per-install, recruiting affiliates, and "customer service".
Jul
13
comment Is this prime number large enough / too large for a Diffie-Hellman for AES-256?
Hey @Marcin is that the 2012 tinfoil hat with quad layer mesh and extended VHF filtering? Does it come in blue?
Jul
13
comment Unknown malware, how to report it and whom to report it to?
You are suggesting connecting a compromised system to the internet, not a good idea.
Jul
13
comment Unknown malware, how to report it and whom to report it to?
Given a clever enough attacker you wouldn't find the file(s). The recent stuxnet malware created a in-RAM-only file by storing encrypted fragments in multiple innocuous places, decrypting the fragments and reassembling them in memory. If this was a similar scheme and the decryption key was in the MBR, then the fragments will be undecipherable.
Jul
12
answered Unknown malware, how to report it and whom to report it to?
Jul
12
revised when people say a file has a checked md5 hash, what exactly does that mean?
added Warning to first example. added section explaining the problem with transfering the hash
Jul
12
comment when people say a file has a checked md5 hash, what exactly does that mean?
@nealmcb quite right. I was trying to keep it simple as the OP seem to indicate confusion. I suppose I should at least put in a warning. Notice I didn't show how Bob got the hash to compare with, that was intentional.
Jul
12
comment Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
What is the data that is being sent between the internal and external server? Of what value is the data to a potential attacker? What are your needs for confidentiality, integrity, and availability? Are you restricted to specific costs or classes of hardware and software?
Jul
12
answered Can .htaccess and .htpasswd really protect me?
Jul
12
comment Design proposals for enhanced security for parts of Internet, e.g. for banking?
It is curious that at the same time the "U.S. is funding stealth Internets to circumvent repressive regimes" they are trying to create a internet neighborhood free of the same tactics.
Jul
12
revised What is preventing the widespread common use of MAC-type systems?
fixed section on formal verification and crashing to comparison of error handling
Jul
12
comment What is preventing the widespread common use of MAC-type systems?
My memory was faulty. Just read "Mathematics, technology, and trust: formal verification, computer security, and the U.S. military" The Multics contract was awarded in 1965. In April of 1969 Bell Labs team (includes Thompson and Ritchie) withdraws. October of 1969 Multics goes into operation. It looks like formal verification did not get going until 1972 with "Proof of Correctness of Data Representations" C.A.R. Hoare
Jul
12
answered when people say a file has a checked md5 hash, what exactly does that mean?
Jul
11
awarded  Organizer
Jul
11
answered Which private-key encryption should I use for server to server communication?
Jul
11
revised What is preventing the widespread common use of MAC-type systems?
removed reference to Multics, removed cheap shot at T&R
Jul
11
comment What is preventing the widespread common use of MAC-type systems?
Oops, my mistake on Multics. The crack about Thompson and Richie was supposed to be a joke. I guess it didn't parse well, I'll remove it. Do you know the last commercial formally verified kernel before Unix?
Jul
11
comment Which private-key encryption should I use for server to server communication?
When you say you 'do not control' do you mean that you lack physical access but have ownership of the hardware and software, or do you mean the hardware is owned by someone else and you control the software on it?
Jul
11
comment mcollective Review and Security Considerations
Have you reviewed it?