7,474 reputation
21744
bio website
location
age
visits member for 4 years, 2 months
seen Jul 17 at 19:58

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Jul
14
comment Unknown malware, how to report it and whom to report it to?
If you think a machine may be compromised, then you treat it as compromised until you can confirm that it is not compromised.
Jul
14
answered Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
Jul
13
awarded  Talkative
Jul
13
comment Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
This looks tricky. High availability with low cost is difficult. How do you current get data from the mobile devices into your internal server, or is the a new capability?
Jul
13
comment Data categorization: Critical or not
Who are the application users? What types of data is the application using? Are you classifying data just for the application or for the application, the operating system, the network stack, etc?
Jul
13
comment Why do malware creators use such clever technologies for such silly purposes?
I like the Developer/User argument. Just like the benign economy the users of software are often not the creators. There is some good reaserch on this malware economy. TrendMicro's "The Business of Cubercrime" is a very readable overview of this complex underground economy. Some highlights: affiliate programs, pay-per-install, recruiting affiliates, and "customer service".
Jul
13
comment Is this prime number large enough / too large for a Diffie-Hellman for AES-256?
Hey @Marcin is that the 2012 tinfoil hat with quad layer mesh and extended VHF filtering? Does it come in blue?
Jul
13
comment Unknown malware, how to report it and whom to report it to?
You are suggesting connecting a compromised system to the internet, not a good idea.
Jul
13
comment Unknown malware, how to report it and whom to report it to?
Given a clever enough attacker you wouldn't find the file(s). The recent stuxnet malware created a in-RAM-only file by storing encrypted fragments in multiple innocuous places, decrypting the fragments and reassembling them in memory. If this was a similar scheme and the decryption key was in the MBR, then the fragments will be undecipherable.
Jul
12
answered Unknown malware, how to report it and whom to report it to?
Jul
12
revised when people say a file has a checked md5 hash, what exactly does that mean?
added Warning to first example. added section explaining the problem with transfering the hash
Jul
12
comment when people say a file has a checked md5 hash, what exactly does that mean?
@nealmcb quite right. I was trying to keep it simple as the OP seem to indicate confusion. I suppose I should at least put in a warning. Notice I didn't show how Bob got the hash to compare with, that was intentional.
Jul
12
comment Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
What is the data that is being sent between the internal and external server? Of what value is the data to a potential attacker? What are your needs for confidentiality, integrity, and availability? Are you restricted to specific costs or classes of hardware and software?
Jul
12
answered Can .htaccess and .htpasswd really protect me?
Jul
12
comment Design proposals for enhanced security for parts of Internet, e.g. for banking?
It is curious that at the same time the "U.S. is funding stealth Internets to circumvent repressive regimes" they are trying to create a internet neighborhood free of the same tactics.
Jul
12
revised What is preventing the widespread common use of MAC-type systems?
fixed section on formal verification and crashing to comparison of error handling
Jul
12
comment What is preventing the widespread common use of MAC-type systems?
My memory was faulty. Just read "Mathematics, technology, and trust: formal verification, computer security, and the U.S. military" The Multics contract was awarded in 1965. In April of 1969 Bell Labs team (includes Thompson and Ritchie) withdraws. October of 1969 Multics goes into operation. It looks like formal verification did not get going until 1972 with "Proof of Correctness of Data Representations" C.A.R. Hoare
Jul
12
answered when people say a file has a checked md5 hash, what exactly does that mean?
Jul
11
awarded  Organizer
Jul
11
answered Which private-key encryption should I use for server to server communication?