3,150 reputation
612
bio website
location
age
visits member for 3 years, 5 months
seen Mar 16 '13 at 22:01

Jun
23
awarded  Yearling
Mar
29
awarded  Enlightened
Mar
29
awarded  Nice Answer
Sep
29
awarded  Nice Answer
Jun
23
awarded  Yearling
May
14
awarded  Nice Answer
Mar
2
answered Necessary education for InfoSec?
Dec
13
answered Authentication without saving password
Sep
28
answered Changing IP ID generation of a server
Aug
27
revised Keeping the password secret over regular http
added 405 characters in body; added 3 characters in body
Aug
27
answered Keeping the password secret over regular http
Aug
27
revised What is a cryptographic puzzle?
added 2 characters in body
Aug
23
comment Is asymmetric encryption ever recommended for long-term storage?
PS: If your largest concern is server compromise, add a HSM into the above asymmetric key scheme so that compromised "public" keys plus encrypted data cannot be used 20 years in the future to decrypt the data, since the HSM was not stolen and is not available for use as oracle (assuming the compromise was detected and remedied within those 20 years). Improving client security is harder.
Aug
23
comment Is asymmetric encryption ever recommended for long-term storage?
Chose the asymmetric keys with some security margin and treat "public" pairs as sensitive secrets on the server. Replace the asymmetric keys when needed, re-encrypting the actually used symmetric keys, and destroy the old counterparts. This scheme is anyway advisable since you must consider key compromise. Obviously you also need backups of those private keys. A secret sharing scheme can be used here, so that e.g., 3 out of the 5 top managers/chiefs must collude to restore your private key. Given this construction, the weakest link will be the symmetric key temporarily stored on your desktop.
Aug
22
comment Is it safer to use less heard of software than popular software?
"I'm discounting the security of relying on a probability" - This is a very academic view. In practice, security is risk management, and thus a probabilistic process. People don't have time to design everything perfectly. Companies base their decisions pro/contra some software on many indicators, but in the end its a probablistic process. I also disagree with independence from popularity. IMO there is clearly a correlation in cases where other software with mostly identical functionality exists. Alternatives become known and used (e.g., sendmail and alternative MDAs).
Aug
22
awarded  Nice Answer
Aug
22
revised Is it safer to use less heard of software than popular software?
added 817 characters in body
Aug
22
comment Is it safer to use less heard of software than popular software?
Unfortunately, its basically infeasible for a non-security expert or people without lots of practical experience to determine these metrics (analysis, measures, patching) for a given software. Most you get is a sourceforge project page or a vendor homepage with PR gibberish.
Aug
22
answered Is it safer to use less heard of software than popular software?
Aug
22
comment Is it safer to use less heard of software than popular software?
Care to substantiate that last claim?