21,245 reputation
19113299
bio website val-id.com
location New York, NY
age 38
visits member for 4 years, 7 months
seen 8 mins ago

The following message is ROT26 encrypted:

Check out my startup at Val-ID, an offline identity company that puts you in control

I'm not looking for a job. I'm going to change the world. The only question is, who wants to do it with me?


Jun
21
comment SSL cert vs public-key authentication
possible duplicate of How does SSL/TLS work?
Jun
20
comment Trying to keep high school students out of the Wi-Fi network
+1 to Lohoris and amccormack ; both technical and non technical approaches are needed.
Jun
5
comment Are there any meta-formats for crypto?
TLS has the ability to negotiate various protocols and encryption. Perhaps that can be used as a basis for what you're asking
Jun
4
comment is Form Authentication more secure than using the session authentication?
confused...........
Jun
4
comment is Form Authentication more secure than using the session authentication?
How does the user get the ticket?
Jun
4
comment is Form Authentication more secure than using the session authentication?
Windows computers can log into an ASP website using the domain username... transparently. This is done using an authentication method. A session is different from an authentication method.
Jun
4
comment is Form Authentication more secure than using the session authentication?
Are you comparing Forms auth to HTTP challenge authentication? Or are you using a NTLM ticket? Kerberos?
May
26
comment Are hashes of hashes used for password storage in practice? Why/why not?
Take a look at "Salt" and "pepper" for passwords... seems like a dupe
May
22
comment When do shared disks “leak” data to other VMs, and how is that mitigated?
@raz Any shared disk based data ( opposed to RAM)
May
21
comment Choose your own exponents in RSA?
See Impacts of not using exponent of 65537 on crypto
May
21
comment Why did Facebook not use HSTS for a long time after it became available?
note to mod - someone voted to close, but I think your answers and links are interesting and can be applied to many other sites. Might be a topic for META but can't post now.
May
21
comment Do we need to logout of webapps?
Does this advice still apply to pressing the back button/history to re-authenicate to a SAML/federated cookie? Would be interesting to see the scenarios that affect the various caching directives... it's probably documented in Google's (old?) Browser Security Handbook
May
21
comment Why do you need to close your browser window after logging out of a website?
Since not every browser acts the same, and plugins and local security software (or proxies) may alter this behavior, I think the advice is a good way to ensure a consistent security posture. Here is an example of why this is needed, because some apps/proxies may cause prior session/SAML auth to be cached. Some SAML providers (facebook, and older ADFS in non cluster mode) are affected security.stackexchange.com/q/8404/396
May
20
comment Should security documentation referencing “state sponsored exploits” be revised to include large corporations also?
That fits what I'm looking for: organized crime. Thanks
May
20
comment Should security documentation referencing “state sponsored exploits” be revised to include large corporations also?
True, but this is security related documentation...
May
20
comment Should security documentation referencing “state sponsored exploits” be revised to include large corporations also?
I wouldn't doubt that in some countries, a corporation can influence a state to act as a proxy. They already place the individuals they want in power by funding their campaigns
May
16
comment Is there any security reason that mail services like gmail or yahoomail limit the size of file attachment?
@ali one file can be bifurcated into many if the SMTP envelope RFC2821 / includes many different SMTP domains. If those domains allow both a two hop NDR AND a full text inclusion of the large attachment, one 1MB file sent to 1,000 people can be expanded into 1 GB outbound, then back inbound with the two hop NDR.. turning 1 MB into 2 GB
May
16
comment What can I do as a user to minimize the risk of online banking?
@André My understanding of ToR is that the SSL connection is terminated at the Exit Node. That node will decrypt your onion traffic and encrypt the SSL traffic. Since it's acting as a bridge, it could see the traffic. I've never done this personally - is this incorrect?
May
14
comment What is the state of the art in internet timing attacks?
The only difference between remote and local timing attacks is the jitter that network devices introduce. Gig Ethernet vs MPLS vs DS3 may have a hand in reducing jitter and increasing the chance of a timing attack.
May
12
comment How does SSL/TLS PKI work?
Related a MASSIVE checklist on implementing a PKI security.stackexchange.com/q/15532/396