Reputation
23,689
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
26 137 358
Impact
~1.8m people reached

Apr
21
comment What's the down side of a dynamic numbered radial keypad?
Is there any research as to the propensity of users towards kinesthetic, vs other approaches? (what are the other approaches?)
Apr
10
comment Is it safe to store SSN's in Azure Cloud?
As a PaaS/SaaS geek I endorse @Xander's statements. In fairness to your customers, also cross reference the Governmental Disclosure list for thier requests for private information. It is part of Google's transparency project, and MSFT has a similar initiative. I don't know if Amazon, Rackspace, Telerik Cloud, Salesforce or the many other less known players have the same transparency. (Dropbox, Box.com,O365, Intermedia, Proofpoint... not to omit any player, but "cloud" is so broad these days)
Mar
17
comment Is a full name and address all that's needed for identity theft?
@iszi didn't the lifelock guy get hacked? and almost regret doing that stunt?
Mar
17
comment Is a full name and address all that's needed for identity theft?
Now that Donald Trump's SSN, address(es) and info has been spilled you'll soon see how easy / hard this is...
Feb
20
comment Does a Mailbox Export Request modify the mailbox data?
@WoJ At a minimum, the server will log that an export was done in the Event log and a few other places
Jan
31
comment Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?
@SteveDL right?! At least it lets me see this on captive networks.
Dec
30
comment Can I store a pair of keys on iOS secure element?
My answer is incorrect. Please see the answer about kSecAttrTokenIDSecureEnclave.
Dec
15
comment Why does not appear the public key from certificate?
I'm learning from the various methods and techniques you shared to get this key. If you want to elaborate that would be quite educational.
Dec
8
comment Why does the issuance speed of a CA depend on the number of certs they have already issued?
Also, I would like to see a EJBCA SQL trace. It could be the ORM (if it uses one) or the driver (Java drivers are terrible)
Dec
8
comment Why does the issuance speed of a CA depend on the number of certs they have already issued?
I would be interested in seeing the Schema and Indexes EJBCA uses. The backend might need maintenance plans, that a suitable DBA can answer.
Dec
4
comment What are reasonable alternatives to “Trust this computer” prompts when signing in?
@halfinformed the scenarios you propose (with a questionmark) are possible answers to the problem I'm solving. What options are available? What makes sense?
Dec
3
comment What are reasonable alternatives to “Trust this computer” prompts when signing in?
@NeilSmithline added
Nov
25
comment Is there a benefit in measuring randomness? How would it be done?
@schroeder I think it might be a metric when observing blackbox or closed source implementations where the developer says "trust us".
Nov
19
comment What stopping someone from offering distributed and encrypted email? Just like Bitcoins
... because the government doesn't want pervasive encryption...
Nov
3
comment Invoke an antimalware scanner from code on azure Roles
I would think that realtime protection would cover you in this scenario... simply upload an EICAR.bin to verify your try catch error handling en.wikipedia.org/wiki/EICAR_test_file
Nov
3
comment Should I accept a self-signed certificate from my university?
In this case you should verify the certificate thumbprint with the school since any student, or hacker can present a near identical cert
Oct
27
comment Should I have special emoticon handling for compliance, audit and logging?
@AndyBoura Telling a health or life insurer that the person has pre existing medical conditions can be indicated in a number of ways. Keywords may need to be augmented as illustrated above.
Oct
23
comment Is there an equivalent of nsp audit for nuget packages?
For those who don't use Node, or are familiar with nsp, can someone add more info? (I had to google it)
Oct
22
comment Where are certificates used to prove identity and why aren't DNS responsible for the job?
You're right, to some extent it is DNS that should be responsible. This is where things are going. Look up DANE (keys in DNS) and how they are secured using DNSSec.
Oct
20
comment Never heard of compiler vulnerabilities when compiling?
Related: In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?