7,474 reputation
21744
bio website
location
age
visits member for 4 years, 2 months
seen Jul 17 at 19:58

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Apr
9
comment Steganography to hide text within text
@mulllhausen Attaching photos and graphics to e-mail is nearly ubiquitous. The larger the ratio of carrier data to secret data the easier it is to hide the secret data. Consider a small secret message of 20 characters. Hiding it in a message of 1200 characters gives you a ratio of 1200 to 20 or 60:1. Consider hiding the same 20 characters in a small jpeg image of 20kb. This time the ratio is 1000:1. Even HTML is a significant improvement over plain text because you can hide information in the formatting.
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
Read security.stackexchange.com/questions/5769/… and security.stackexchange.com/questions/67819/… for reference. Are you mixing content type for plausable deniability?
Apr
9
comment Steganography to hide text within text
Are you using text because of transmission channel restrictions or you think it would look more innocent to a third party?
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
You need to verify the contents or just that the content integrity is unchanged since it was created? Are data segments going to be split and remixed?
Apr
9
comment What's a term to describe multiple shoulder surfing attacks to uncover different parts of the password?
Advanced Shoulder Surfing with Half Observable Length Enumeration
Apr
8
comment How prevent online payment fraud?
Do authorization and settling take place over separate channels? Is authorization made for an amount or just for a transaction? We need some details otherwise this reduces to the "Two Generals Paradox" which is unsolvable.
Apr
8
comment How prevent online payment fraud?
Who are the actor here? Please explain the green and red connections. Is the Bank a payment processor?
Apr
7
comment Mars Curiosity Rover Security
As a US Government agency, NASA would fall under the supervision of the NSA. I believe the Red Black categorization originates from the NSA and is repeated by other agencies that must have their certification for operation of sensitive resource
Apr
7
comment Why do websites ask for the last four digits of your social security number?
That is only for "funds transfer in the amount of $3,000 or more" and for an "originator that is not an established customer"
Oct
22
comment How to catch a gmail hacker/money-scammer? (in conversation with one right now!)
@Nicholas I was unable to find a reference for attacks on individuals. To be fair most of my knowlege is about attacks on companies, where there are references like the Verizon Data Breach Investigations Report.
Jun
1
comment Physical security - responsible disclosure
Attempt to contact the security seal manufacturer directly. If that fails try e-mailing the International Seal Manufacturers Association (ISMA) ismasecurity.com/Contact-Us.html
Jun
1
comment Can someone please briefly explain HIPPA compliance?
There is a fundamental problem with the question asker, and potentially others interested in the question; that HIPPA compliance, and by proxy system security is a checklist or certificate to hang on the wall. That compliance is a milestone on the way to profit. Failure on the part of technology builders to address user's privacy or security has real and lasting impact on the users. For those who don't take their responsibility seriously, the only emphasis they understand is risk to their own self-interest.
May
31
comment Can someone please briefly explain HIPPA compliance?
Ask your legal team: What do I need to do, so I don't go to jail?
May
31
comment Why is it considered safe for services like Mint to store bank password?
I wish more people understood the basic concept of risk. Nicely put, you can never have zero risk, just more or less.
May
31
comment Why is it considered safe for services like Mint to store bank password?
please read more broadly security.stackexchange.com/questions/10820/…
May
31
comment Should statically-linked server binaries (daemons) be deemed more secure?
You need to provide a measure or goal for "less prone" to attack vectors. By number of attacks, type, severity, consequence, remediation cost, etc.
May
21
comment Deleting a Java Object securely
@jbyler From Java Cryptography Architecture (JCA) "The KeyStore class supplies well-defined interfaces to access and modify the information in a keystore." The exact protection depends on the Java implementation: Oracle/Sun, Android, or other.
May
21
comment What chars should I not allow in passwords?
@Luc for password in {{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..‌​Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}; do echo -n $password | md5sum>>rainbow; echo $password >>rainbow; done; echo "8-character letter-only rainbow tables for md5, simply grep for md5 and get password, no gpu required"
Oct
3
comment Could mint.com be more secure, and if so, how?
Law is the easiest remedy. Make online service providers liable for the full amount of any loss incured by an individual and due within seven days of the loss event. To align security interests, align the financial interests.
Sep
12
comment Is there a pre-existing taxonomy of attackers?
the NSA doesn't have an interest in you, they did try, but its just not working out