21,270 reputation
19113299
bio website val-id.com
location New York, NY
age 38
visits member for 4 years, 7 months
seen 9 hours ago

The following message is ROT26 encrypted:

Check out my startup at Val-ID, an offline identity company that puts you in control

I'm not looking for a job. I'm going to change the world. The only question is, who wants to do it with me?


Sep
13
accepted What risk does commoditized dedicated SHA256 processors pose to IT Operations?
Sep
12
asked What risk does commoditized dedicated SHA256 processors pose to IT Operations?
Sep
9
awarded  Famous Question
Sep
8
awarded  Nice Answer
Sep
2
awarded  Popular Question
Aug
31
accepted Sample challenge questions for use with self service password reset and validation
Aug
31
asked Is it a risk to highlight text while reading a webpage?
Aug
28
awarded  Popular Question
Aug
22
comment Why would encrypting data result in a call to a Domain Controller
So I guess that means that OIDs are stored in AD somewhere for this to work? Is there any legitimate reason for this feature?
Aug
22
accepted Why would encrypting data result in a call to a Domain Controller
Aug
11
comment Securing Windows 7 using Bluetooth
A normal smart card reader has a physical connection to the PC. If you want to share your SMIME or other PKI keys between multiple devices (phone, laptop, tablet) this should allow you to walk away from your PC and make it lock
Aug
11
revised Blackberry + RIM Bluetooth-based Smart Card Reader
added 15 characters in body; edited body
Aug
10
revised Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
added 106 characters in body; added 37 characters in body; deleted 315 characters in body
Aug
10
answered Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
Aug
9
answered How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
Aug
8
awarded  Announcer
Aug
7
comment Sample challenge questions for use with self service password reset and validation
In the article I linked my question to, the author recommends a SMS / out of band validation and an optional Q&A section. (see flowchart at the bottom). The threat I'm trying to mitigate is where someone borrows an unlocked phone, sees the SMS and resets the password. I need a "something you know" component that isn't the account number.
Aug
6
asked Sample challenge questions for use with self service password reset and validation
Jul
31
asked How do the STS token formats compare to each other SAML vs SWT vs JWT?
Jul
30
accepted What risks do Cookieless sessions have? What are the mitigations?