20,678 reputation
18107292
bio website val-id.com
location New York, NY
age 38
visits member for 4 years, 5 months
seen 19 mins ago

The following message is ROT26 encrypted:

Check out my startup at Val-ID, an offline identity company that puts you in control

I'm not looking for a job. I'm going to change the world. The only question is, who wants to do it with me?


17h
comment How can I explain “zero knowledge proof” to an end user?
Perhaps I could use the recipe for KFC, or Coke as an analogy... They have no knowledge of the recipe, but can say it tastes like the real thing.
Apr
21
comment Minimize risk with Windows 2003 end of life
@schroeder Extended support ends soon for Win2003...
Apr
19
comment Can free email provider's partners and affiliates read your emails?
In theory they can also edit your emails, and create valid looking replies.
Apr
17
comment Should SSL be terminated at a load balancer?
@PiyushKansal Some companies have a network layer VPN in these instances, so you don't have to worry about this, but if this doesn't exist yes, I would re-encrypt. I don't know about your particular situation, but there may be things to consider like the SafeHarbor ( safeharbor.export.gov/list.aspx ) trust lists, and your company's legal responsibility in an international situation like yours
Apr
12
comment Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?
@schroeder I'm writing an app for iOS and Android that requests resolution of a DNS name. I assume that no such extension exists, or for idealistic reasons, it doesn't exist either. I want to have a guarantee to my app that the DNS host is really the DNS host that is expected ... (using a local resolver, or an imported Java or iOS resolver)
Apr
10
comment Official proof (document) that Linux is safer and faster than Windows
This is opinion, and therefore no such document will exist.
Apr
10
comment Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?
I just read that note... somewhat abstract points he is saying. He does seem to say that a "local policy" is what trumps a global policy... specifically on the Caching Server. If a caching server is in my "local policy" realm of influence, I don't see why I can't have a local policy that says "ensure that this DNS label is not spoofed via DNSSEC". Since he works for Ultra, and I'm a UltraDNS customer, I'll open a support ticket....
Apr
10
comment How to get started with DNSSEC?
@schroeder I should have put this in my comment, NSEC3 is an enhancement that prevents the enumeration of a DNSSEC zone, the way that the default NSEC does. You can enumerate all my DNS records if you enable "confirm non exist domains" at Verisign or some of the other online scanners. Experiment with getvalid.com if you want.
Apr
10
comment How to get started with DNSSEC?
IMHO - Look for a DNS Server that has NSEC3 support... If you find one let me know. I may be migrating away from dyn.com because of this.
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
Does my edit to the post clarify / constrain what's to be proven sufficiently?
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
Also, in all cases, the data sets (product IDs for eBay, and users on a ballot) are common knowledge. The users selection of a product or candidate are private, along with the paring of a bid or a ranked preference, is also private
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
@this.josh I need to verify that the contents is data an encrypted vote for a person (a single value of a set for first past the post FPTP, or ranked 1st place 2nd place, etc for alternative vote). The data segments should be small, product ID + bid.
Apr
9
comment In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?
Thank you, I'd be interested in learning what constraints are possible..
Apr
6
comment Should name constraints be present on a subordinate CA issued to an organization?
Do you know of anything "better" than the current DNSSec? Either a modified RFC, or something redone from the ground up?
Apr
6
comment Should name constraints be present on a subordinate CA issued to an organization?
If only DNSSec didn't require very weak RSA keys... and if only it supported faster/better crypto like EC....
Mar
30
comment Can 'cracked' product keys harm the user in any way?
@PaŭloEbermann - Completely agree, but I've seen it happen
Mar
27
comment Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?
The header should ONLY be sent over HTTPS connections. This is to prevent issues with broken clients who don't follow the RFC
Mar
25
comment Is PGP or S/MIME useful when both servers are self-controlled?
Do you trust your backup tapes, where they are archived off site?
Mar
24
comment In DNSSec, are Delegation Signer Records always SHA-1?
The more I learn about DNSSec, the less I like it. sockpuppet.org/blog/2015/01/15/against-dnssec
Mar
22
comment Is it unwise to use Redis to store PII, private keys, and other secrets?
Thank you for the tips regarding design, mitigation, and the threat assessment.