Reputation
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
24 133 347
Impact
~1.6m people reached

Jan
31
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
@SteveDL right?! At least it lets me see this on captive networks.
Dec
30
comment Can I store a pair of keys on iOS secure element?
My answer is incorrect. Please see the answer about kSecAttrTokenIDSecureEnclave.
Dec
15
comment Why does not appear the public key from certificate?
I'm learning from the various methods and techniques you shared to get this key. If you want to elaborate that would be quite educational.
Dec
8
comment Why does the issuance speed of a CA depend on the number of certs they have already issued?
Also, I would like to see a EJBCA SQL trace. It could be the ORM (if it uses one) or the driver (Java drivers are terrible)
Dec
8
comment Why does the issuance speed of a CA depend on the number of certs they have already issued?
I would be interested in seeing the Schema and Indexes EJBCA uses. The backend might need maintenance plans, that a suitable DBA can answer.
Dec
4
comment What are reasonable alternatives to “Trust this computer” prompts when signing in?
@halfinformed the scenarios you propose (with a questionmark) are possible answers to the problem I'm solving. What options are available? What makes sense?
Dec
3
comment What are reasonable alternatives to “Trust this computer” prompts when signing in?
@NeilSmithline added
Nov
25
comment Is there a benefit in measuring randomness? How would it be done?
@schroeder I think it might be a metric when observing blackbox or closed source implementations where the developer says "trust us".
Nov
19
comment What stopping someone from offering distributed and encrypted email? Just like Bitcoins
... because the government doesn't want pervasive encryption...
Nov
3
comment Invoke an antimalware scanner from code on azure Roles
I would think that realtime protection would cover you in this scenario... simply upload an EICAR.bin to verify your try catch error handling en.wikipedia.org/wiki/EICAR_test_file
Nov
3
comment Should I accept a self-signed certificate from my university?
In this case you should verify the certificate thumbprint with the school since any student, or hacker can present a near identical cert
Oct
27
comment Should I have special emoticon handling for compliance, audit and logging?
@AndyBoura Telling a health or life insurer that the person has pre existing medical conditions can be indicated in a number of ways. Keywords may need to be augmented as illustrated above.
Oct
23
comment Is there an equivalent of nsp audit for nuget packages?
For those who don't use Node, or are familiar with nsp, can someone add more info? (I had to google it)
Oct
22
comment Where are certificates used to prove identity and why aren't DNS responsible for the job?
You're right, to some extent it is DNS that should be responsible. This is where things are going. Look up DANE (keys in DNS) and how they are secured using DNSSec.
Oct
20
comment Never heard of compiler vulnerabilities when compiling?
Related: In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?
Oct
13
comment HTML Injection on iOS?
Related: Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)
Oct
8
comment Is the newly adopted NFC technology going to be safe?
Which ones are bi-directional? just NFCIP-1 ?
Oct
8
comment Google Blacklist Workaround?
Possible duplicate of Why does Google Safe Browsing keep detecting malware on my website?
Oct
5
comment What advantage does the Bloomberg authentication system have over traditional 2 factor?
@jhash I didn't see the whole authentication process...
Sep
24
comment What guarantees does perfect forward secrecy make with respect to compromise of a private key?
This is related to "Half PFS" and the vulnerabilities therein security.stackexchange.com/q/99935/396