7,102 reputation
11440
bio website
location
age
visits member for 3 years, 3 months
seen Sep 9 at 22:45

The first rule of security is: you do not invent security protocols.

The second rule of security is: you do not invent security protocols!

The third rule of security is: if this is your first time with security you do not invent security protocols.

Inventing, modifying, tweaking, hacking, extending, optimizing, or just about anything else you can do to a cryptographic protocol, hash, algorithm, PRNG, key agreement, or cryptographic technique is a very bad idea.

(Not dead.)


Jun
1
comment Physical security - responsible disclosure
Attempt to contact the security seal manufacturer directly. If that fails try e-mailing the International Seal Manufacturers Association (ISMA) ismasecurity.com/Contact-Us.html
Jun
1
comment Can someone please briefly explain HIPPA compliance?
There is a fundamental problem with the question asker, and potentially others interested in the question; that HIPPA compliance, and by proxy system security is a checklist or certificate to hang on the wall. That compliance is a milestone on the way to profit. Failure on the part of technology builders to address user's privacy or security has real and lasting impact on the users. For those who don't take their responsibility seriously, the only emphasis they understand is risk to their own self-interest.
May
31
comment Can someone please briefly explain HIPPA compliance?
Ask your legal team: What do I need to do, so I don't go to jail?
May
31
comment Why is it considered safe for services like Mint to store bank password?
I wish more people understood the basic concept of risk. Nicely put, you can never have zero risk, just more or less.
May
31
comment Why is it considered safe for services like Mint to store bank password?
please read more broadly security.stackexchange.com/questions/10820/…
May
31
comment Should statically-linked server binaries (daemons) be deemed more secure?
You need to provide a measure or goal for "less prone" to attack vectors. By number of attacks, type, severity, consequence, remediation cost, etc.
May
21
comment Deleting a Java Object securely
@jbyler From Java Cryptography Architecture (JCA) "The KeyStore class supplies well-defined interfaces to access and modify the information in a keystore." The exact protection depends on the Java implementation: Oracle/Sun, Android, or other.
May
21
comment What chars should I not allow in passwords?
@Luc for password in {{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}{{A..‌​Z},{a..z}}{{A..Z},{a..z}}{{A..Z},{a..z}}; do echo -n $password | md5sum>>rainbow; echo $password >>rainbow; done; echo "8-character letter-only rainbow tables for md5, simply grep for md5 and get password, no gpu required"
Oct
3
comment Could mint.com be more secure, and if so, how?
Law is the easiest remedy. Make online service providers liable for the full amount of any loss incured by an individual and due within seven days of the loss event. To align security interests, align the financial interests.
Sep
12
comment Is there a pre-existing taxonomy of attackers?
the NSA doesn't have an interest in you, they did try, but its just not working out
Sep
12
comment Did US and UK spy agencies defeat privacy and security on the internet?
The prefered M.O. for covert action is targeted, i.e. a few people rather than whole group. BlueCoat is unnoticed in environments where the end point trusts a enterprise cert and the intercepting proxy is signed by the enterprise cert
Sep
4
comment Is it possible to find who posted comment on my blogspot anonymously?
In many cases it is possible to find who posted a comment, but it is rarely worth the effort.
Aug
29
comment Incentives to Support Adoption of the Cybersecurity Framework
"a Federal legal privilege that preempts State disclosure requirements." Civil War 2? East versus West
Aug
21
comment What are the security implications of the POLi Internet Payments technique?
Welcome to IT Security. If you could limit your question to one specific aspect of security I think you will receive a better response. Perhaps a question about the implications for fraud.
Aug
20
comment Risks of Mullions in High Security Areas
Don't your doors and walls have stuff in them? I would hope a secure door is not hollow. Are the walls hollow? What is the address again?
Aug
13
comment Risks of Mullions in High Security Areas
I would be most concerned about someone drilling through the apparently hollow mullion just to do reconnaissance on the assets inside. Sometimes knowing what is inside is all an adversary needs.
Aug
12
comment Is Windows BitLocker secure?
If the machine is off, there are no non-physical attacks that are effective. Network based attacks require a machine to be available on a network.
Aug
12
comment Secure alternative to e-mail
Security must be defined in terms of Confidentiality, Integrity, and Availability. E-mail is a method of textual communication which make transit across a public network of networks. Do you wish confidentiality of sender identity, integrity of message, restriction of access of message content to a specified recipient? Confidentiality of recipient is beyond technical application under the current concept of e-mail.
Jun
16
comment Can the U.S. goverment crack encryption?
Quantum computers already exist.
Jun
16
comment What are the implications of NSA surveillance on the average internet user?
I did. No one listened.