21,123 reputation
19108296
bio website val-id.com
location New York, NY
age 38
visits member for 4 years, 6 months
seen 51 mins ago

The following message is ROT26 encrypted:

Check out my startup at Val-ID, an offline identity company that puts you in control

I'm not looking for a job. I'm going to change the world. The only question is, who wants to do it with me?


3h
comment Design Principle violated by Certificate Revocation List (CRL)
Least privilege - anyone can download a CRL and see that new CRLs have been added to the revocation list. Now you provide an answer as SteveDL suggests...
3h
comment Design Principle violated by Certificate Revocation List (CRL)
Sounds like a neat class. Where is it?
1d
comment Are hashes of hashes used for password storage in practice? Why/why not?
Take a look at "Salt" and "pepper" for passwords... seems like a dupe
May
22
comment When do shared disks “leak” data to other VMs, and how is that mitigated?
@raz Any shared disk based data ( opposed to RAM)
May
21
comment Choose your own exponents in RSA?
See Impacts of not using exponent of 65537 on crypto
May
21
comment Why did Facebook not use HSTS for a long time after it became available?
note to mod - someone voted to close, but I think your answers and links are interesting and can be applied to many other sites. Might be a topic for META but can't post now.
May
21
comment Do we need to logout of webapps?
Does this advice still apply to pressing the back button/history to re-authenicate to a SAML/federated cookie? Would be interesting to see the scenarios that affect the various caching directives... it's probably documented in Google's (old?) Browser Security Handbook
May
21
comment Why do you need to close your browser window after logging out of a website?
Since not every browser acts the same, and plugins and local security software (or proxies) may alter this behavior, I think the advice is a good way to ensure a consistent security posture. Here is an example of why this is needed, because some apps/proxies may cause prior session/SAML auth to be cached. Some SAML providers (facebook, and older ADFS in non cluster mode) are affected security.stackexchange.com/q/8404/396
May
20
comment Should security documentation referencing “state sponsored exploits” be revised to include large corporations also?
That fits what I'm looking for: organized crime. Thanks
May
20
comment Should security documentation referencing “state sponsored exploits” be revised to include large corporations also?
True, but this is security related documentation...
May
20
comment Should security documentation referencing “state sponsored exploits” be revised to include large corporations also?
I wouldn't doubt that in some countries, a corporation can influence a state to act as a proxy. They already place the individuals they want in power by funding their campaigns
May
16
comment Is there any security reason that mail services like gmail or yahoomail limit the size of file attachment?
@ali one file can be bifurcated into many if the SMTP envelope RFC2821 / includes many different SMTP domains. If those domains allow both a two hop NDR AND a full text inclusion of the large attachment, one 1MB file sent to 1,000 people can be expanded into 1 GB outbound, then back inbound with the two hop NDR.. turning 1 MB into 2 GB
May
16
comment What can I do as a user to minimize the risk of online banking?
@André My understanding of ToR is that the SSL connection is terminated at the Exit Node. That node will decrypt your onion traffic and encrypt the SSL traffic. Since it's acting as a bridge, it could see the traffic. I've never done this personally - is this incorrect?
May
14
comment What is the state of the art in internet timing attacks?
The only difference between remote and local timing attacks is the jitter that network devices introduce. Gig Ethernet vs MPLS vs DS3 may have a hand in reducing jitter and increasing the chance of a timing attack.
May
12
comment How does SSL/TLS PKI work?
Related a MASSIVE checklist on implementing a PKI security.stackexchange.com/q/15532/396
May
7
comment Possible to use custom SSL or TCP/IP packets to detect VPN use?
@raz I am a web host (or socket server) that wants to detect intentional violations of copyright, but using VPNs to access material outside of designated locations.
May
7
comment How to make sure that the cryptographic hardware accelerator is being used in am335x?
This might be the only question of this nature on this site, despite having a few amazing hardware focused answers from Thomas Pornin and others that discusses hardware-based security in such a detailed way. Therefore I'm upvoting and not voting to move to Electronics.SE or Stackoverflow.
Apr
29
comment Signing the Recovery Partition
Apple has an online recovery method (command-R at boot) that might accommodate this request internally.
Apr
27
comment Are there any Distributed/mesh-like/P2P VPNs?
Yes, what you want does exist, for on-LAN communication if the devices are local. It's the Azure Service Bus
Apr
27
comment “Authorized” Man in the middle
Cisco, Microsoft, and other companies also have SSL inspection features that work the same way...