meta user
network profile
| bio | website | |
|---|---|---|
| location | Frederick, MD | |
| age | ||
| visits | member for | 1 year, 11 months |
| seen | Apr 29 at 12:53 | |
| stats | profile views | 7 |
|
Jun 9 |
awarded | Yearling |
|
Jun 8 |
awarded | Caucus |
|
Feb 20 |
comment |
How long should the password be? Also wired.com/politics/security/commentary/securitymatters/2007/01/… |
|
Oct 3 |
comment |
Is TDEA (TripleDES) invulnerable to the weak keys of DES? @AviD I completely agree. |
|
Sep 14 |
accepted | Is TDEA (TripleDES) invulnerable to the weak keys of DES? |
|
Aug 29 |
awarded | Commentator |
|
Aug 29 |
comment |
How can I decrypt data with Java, without hard-coding the key? Have you heard of Microsoft's Data Protection API (DPAPI)? There's a wrapper for Java: jdpapi.sourceforge.net |
|
Aug 26 |
comment |
How can I decrypt data with Java, without hard-coding the key? "Storing secret information—data such as encryption keys, signing keys, and passwords—in software in a completely secure fashion is impossible with current PC hardware…The trick is to raise the security bar high enough to make it very difficult for anyone other than appropriate users to access the secret data." Writing Secure Code (2nd ed.) chapter nine. Microsoft Press. |
|
Aug 26 |
comment |
How can I decrypt data with Java, without hard-coding the key? +1 good answer. I would add that if you store the password in a file on the computer, it can be protected via a file ACL. If this is a service, the initialization could be run as a user which has read access to the file but after initialization, the app would run under a different user that doesn't have read access. In general, pure software solutions can raise the bar only so high. |
|
Aug 25 |
awarded | Teacher |
|
Aug 23 |
revised |
Is TDEA (TripleDES) invulnerable to the weak keys of DES? added 31 characters in body; edited title |
|
Aug 23 |
answered | Is TDEA (TripleDES) invulnerable to the weak keys of DES? |
|
Aug 23 |
comment |
Is TDEA (TripleDES) invulnerable to the weak keys of DES? This is a great answer. +1 Thank you. |
|
Aug 23 |
comment |
Is TDEA (TripleDES) invulnerable to the weak keys of DES? "There are a few keys that are considered weak for the DEA cryptographic engine. The use of weak keys can reduce the effective security afforded by TDEA and should be avoided." - p. 24 of the PDF |
|
Aug 23 |
comment |
Is TDEA (TripleDES) invulnerable to the weak keys of DES? Thanks for your answer. So, the multiple pass method of 3DES doesn't provide any defense against the weak keys. Can you cite a reference? |
|
Aug 23 |
asked | Is TDEA (TripleDES) invulnerable to the weak keys of DES? |
|
Jun 11 |
awarded | Nice Question |
|
Jun 10 |
comment |
Is it a vulnerability to display exception messages in an error page? @Soumya92 Thanks. > "At best, give them an ID they can correlate to your log." -- we are changing our page to do that. It will provide a generic error message, an apology for the inconvenience, the current date, and a number for us to be able to correlate their report to the log entry. |
|
Jun 9 |
comment |
Is it a vulnerability to display exception messages in an error page? Thank you. Good points. |
|
Jun 9 |
comment |
Is it a vulnerability to display exception messages in an error page? @Simon I think none. |
