6,844 reputation
11339
bio website
location
age
visits member for 2 years, 10 months
seen Feb 4 at 7:22

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Oct
3
comment Could mint.com be more secure, and if so, how?
Law is the easiest remedy. Make online service providers liable for the full amount of any loss incured by an individual and due within seven days of the loss event. To align security interests, align the financial interests.
Sep
12
comment Is there a pre-existing taxonomy of attackers?
the NSA doesn't have an interest in you, they did try, but its just not working out
Sep
12
comment Did US and UK spy agencies defeat privacy and security on the internet?
The prefered M.O. for covert action is targeted, i.e. a few people rather than whole group. BlueCoat is unnoticed in environments where the end point trusts a enterprise cert and the intercepting proxy is signed by the enterprise cert
Sep
4
comment Is it possible to find who posted comment on my blogspot anonymously?
In many cases it is possible to find who posted a comment, but it is rarely worth the effort.
Aug
29
comment Incentives to Support Adoption of the Cybersecurity Framework
"a Federal legal privilege that preempts State disclosure requirements." Civil War 2? East versus West
Aug
21
comment What are the security implications of the POLi Internet Payments technique?
Welcome to IT Security. If you could limit your question to one specific aspect of security I think you will receive a better response. Perhaps a question about the implications for fraud.
Aug
20
comment Risks of Mullions in High Security Areas
Don't your doors and walls have stuff in them? I would hope a secure door is not hollow. Are the walls hollow? What is the address again?
Aug
13
comment Risks of Mullions in High Security Areas
I would be most concerned about someone drilling through the apparently hollow mullion just to do reconnaissance on the assets inside. Sometimes knowing what is inside is all an adversary needs.
Aug
12
comment Is Windows BitLocker secure?
If the machine is off, there are no non-physical attacks that are effective. Network based attacks require a machine to be available on a network.
Aug
12
comment Secure alternative to e-mail
Security must be defined in terms of Confidentiality, Integrity, and Availability. E-mail is a method of textual communication which make transit across a public network of networks. Do you wish confidentiality of sender identity, integrity of message, restriction of access of message content to a specified recipient? Confidentiality of recipient is beyond technical application under the current concept of e-mail.
Jun
16
comment Can the U.S. goverment crack encryption?
Quantum computers already exist.
Jun
16
comment What are the implications of NSA surveillance on the average internet user?
I did. No one listened.
Jun
14
comment What are the implications of NSA surveillance on the average internet user?
Actually I've always cared.
Jun
13
comment When to use SSL ? / When to send passwords via mail?
Mandatory as in use HTTP go to jail? Will OWASP take away my library card?
Jun
13
comment Online only encryption
What are you trying to protect, confidentiality? And from who? Passing notes on Fermat's Last Theorem might only need rot13.
Jun
11
comment Files to monitor in linux
MD5 hash data should include file size as MD5 is vulnerablt to length extension attacks (en.wikipedia.org/wiki/Length_extension_attack)
May
29
comment How I can prove that SSH attacks are not from my application?
Proof to whose satisfaction?
May
4
comment I'm being followed on the web. Explanations for mysterious behavior
actually TLA's do use stupid tactics see:ifixit.com/Teardown/Tracking+Device+Teardown/5250/1
Mar
4
comment Choosing an SSL certificate provider
Welcome to IT Security. Please explain the security issue you are interested in. If you are only interested in device usage and compatability your question may be better answered on a different site.
Feb
27
comment Possible ways to test security for Windows Phone 7 or iOS devices
Welcome to IT Sec. I am unable to see any security relevant issues in your question. Please give the security relevant issues you are interested in. If there are no security relevant issues then the question belongs on a different site.