6,844 reputation
11339
bio website
location
age
visits member for 2 years, 10 months
seen Feb 4 at 7:22

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Jul
1
comment GOST cipher test vectors
What are you testing? If you are trying to break GOST see Security Evaluation of GOST 28147-89 In View Of International Standardisation
Jul
1
comment Using password hash as session ID?
I'm confused. You say you don't care about state, but then you say that the state has been established: the user has been identified and authenticated and a secure channel has been setup. It seems like you are using the fact that the secure channel has been set up to keep state.
Jun
30
suggested suggested edit on What to transfer? Password or its hash?
Jun
30
comment Warn about specific CA in Firefox
Let me see if I understand. If Host X is whitelisted and Host Y is not whitelisted: a user's browser with a HTTPS connection to Host X through Proxy P will see a cert for Host X. a user's browser with a HTTPS connection to Host Y will see a cert for Proxy P. And you want the browser to show the name on the cert for any HTTPS connection? I would think that a standard browser configuration would put up a page warning that the cert doesn't match the URL.
Jun
30
comment Solution to allow JavaScript input but prevent XSS
Does the JavaScript input need to be available right away? This may be to burdensome, but what about reviewing and aproving user submitted JavaScript?
Jun
30
comment Solution to allow JavaScript input but prevent XSS
Good explanation of what https does, and cockie access.
Jun
30
revised I want to be web security consultant?
addressing a more web centric position
Jun
30
comment Using computer random number generators to produce keys, it is secure?
@Fixee, I did not understand that you meant combining a variety of different sources. I thought you were asking about single sources. In that case, I think a mix of pseudo-random sources is just as good as a hardware generator. After all entropy is entropy no matter where it comes from. However there is a danger of using a poor source as many programmers don't pick the best available source.
Jun
30
awarded  Nice Answer
Jun
30
comment I want to be web security consultant?
@Graham-Lee Good criticism, I'll make some revisioms. However, the OP did say 'web security consultant' which to me means you have to be very knowlegeable in a wide range of topic. For your point 2. making use of other people results, I see people who do not really understand the results attempt to apply them blindly and incorrectly. I reviewed a design from a senior engineer at a very large firm who wanted to add checksums to messages sent by TCP. If he knew his networking he would have known that TCP already has checksums built in.
Jun
30
comment Initial steps of network mapping
You just attempt every IP within the network mask. If you don't know the netwok mask try some standard network masks like 0xffffff00 or 0xffff0000. Try to find out who their ISP is and see if you can identify IP allocations for their ISP. Use automated IP range scanners, look for example DMZ configurations (Cisco, Microsoft, Red Hat, etc) sometimes the layout will be exactly the same as in the example.
Jun
30
answered I want to be web security consultant?
Jun
29
comment Using computer random number generators to produce keys, it is secure?
@Fixee Becase the events are bounded. Key strokes are quantized by the keyboard controller. Transfer protocol often group keystrokes together, erasing the timing data. If time of day is calculated when the user runs the application, then the user's activity patterns limit the range of values. Depending on how you define current weather it is predictable to an extent. Stock indexes are also limited, they rarely change more than some percentage each day. See "Software Generation of Practically Strong Numbers"(citeseerx.ist.psu.edu/viewdoc/…)
Jun
29
comment Virtualization as a layer of security for desktop computers?
Would you explain the issues related to data transfer? Do you believe that data transfer between application VM and host file system is less secure than between a application on the host and the host file system?
Jun
29
comment Virtualization as a layer of security for desktop computers?
Nice response. I liked how you went through the OP points.
Jun
29
answered Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Jun
29
answered Using computer random number generators to produce keys, it is secure?
Jun
28
comment Email Spoofed. Explain?
I agree with @palo-ebermann. This is not necessarily indicative of a breach of your e-mail account. It was years ago I leaned how to telnet to port 25 to interact with sendmail. However the attacker doesn't even need this minor level of sophistication to spoof your e-mail address. As a precaution change your password and review athe Gmail security checklist Check 'Last account activity' to see if there are times or IP addresses that don't look like you.
Jun
28
comment Email Spoofed. Explain?
It is difficult to get casual e-mail users to configure their e-mail clients for signature verification. I wish I could get everyone I send e-mail to import my public key into their clients.
Jun
28
revised key-management wiki excerpt
added 220 characters in body