21,591 reputation
20118305
bio website val-id.com
location New York, NY
age 38
visits member for 4 years, 8 months
seen 24 mins ago

The following message is ROT26 encrypted:

Check out my startup at Val-ID, an offline identity company that puts you in control

I'm not looking for a job. I'm going to change the world. The only question is, who wants to do it with me?


Aug
31
asked Is it a risk to highlight text while reading a webpage?
Aug
28
awarded  Popular Question
Aug
22
comment Why would encrypting data result in a call to a Domain Controller
So I guess that means that OIDs are stored in AD somewhere for this to work? Is there any legitimate reason for this feature?
Aug
22
accepted Why would encrypting data result in a call to a Domain Controller
Aug
11
comment Securing Windows 7 using Bluetooth
A normal smart card reader has a physical connection to the PC. If you want to share your SMIME or other PKI keys between multiple devices (phone, laptop, tablet) this should allow you to walk away from your PC and make it lock
Aug
11
revised Blackberry + RIM Bluetooth-based Smart Card Reader
added 15 characters in body; edited body
Aug
10
revised Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
added 106 characters in body; added 37 characters in body; deleted 315 characters in body
Aug
10
answered Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
Aug
9
answered How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
Aug
8
awarded  Announcer
Aug
7
comment Sample challenge questions for use with self service password reset and validation
In the article I linked my question to, the author recommends a SMS / out of band validation and an optional Q&A section. (see flowchart at the bottom). The threat I'm trying to mitigate is where someone borrows an unlocked phone, sees the SMS and resets the password. I need a "something you know" component that isn't the account number.
Aug
6
asked Sample challenge questions for use with self service password reset and validation
Jul
31
asked How do the STS token formats compare to each other SAML vs SWT vs JWT?
Jul
30
accepted What risks do Cookieless sessions have? What are the mitigations?
Jul
27
comment What risks do Cookieless sessions have? What are the mitigations?
+1 Hmm, what about wrapping the page requiring a session in an iFrame, hiding the URL
Jul
27
asked What risks do Cookieless sessions have? What are the mitigations?
Jul
24
revised What are the biggest unsolved problems in IT Security?
added 41 characters in body
Jul
23
accepted How reliable/secure is QCaptcha?
Jul
23
revised Is there any way to set up secure email for Network Solutions domains?
Welcome to the site Ken! The tradition is that we don't sign our posts with our name or handle.
Jul
23
comment Why would encrypting data result in a call to a Domain Controller
Are you saying that you debugged VerifyData to see the call to AD? I'm not sure if a CA even needs to be present to make the API connect to AD (RSA can make its own keys). Does the call still exist when the CA is moved to a non DC?