meta user
network profile
| bio | website | lamontconsulting.com |
|---|---|---|
| location | New York, NY | |
| age | 36 | |
| visits | member for | 2 years, 6 months |
| seen | 7 hours ago | |
| stats | profile views | 639 |
The following message is ROT26 encrypted:
SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:
TLSA (formerly DANE for DNS) Fixes the hackable CA problem
TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack
About me
I have no relation to the above sites; I am just an advocate
Why "makerofthings7"? It's a challenge to "make seven things in my life of significant quality and value". Who knows if those things will take the form of software, art, or people. (I'm not married, no kids yet)
See ...my LinkedIn profile
Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk
|
1d |
comment |
Lessons learned and misconceptions regarding encryption and cryptology This also opens the door for a Two time pad attack, that bit Microsoft PPTP. The first version of PPTP used the same key in the client and the server |
|
1d |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Here is a right example: Suppose a crypto designer doesn't want to reuse the same key for multiple messages. One solution is to generate one key and expand it using a PRG. Then only use each multiple of x bits as a key. Where segment 1 == key 1, segment 2 == key 2. |
|
1d |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Here is a wrong example: WEP implemented RC4 with a 24 bit nonce that increases after each message. This introduced two issues: (1) after 2^24 packets were sent, nonces were reused. (2) RC4 wasn't designed to have nonces "closely related" where it is known that each subsequent cipher was ++ the value of the previous. |
|
1d |
comment |
Lessons learned and misconceptions regarding encryption and cryptology Would you edit "As I'm not reusing the key, there is no way to attack the ciphertext by subtracting one message from another." and add text saying that other attacks are possible? EXAMPLE: a two time pad, bad protocol, or other bias (PPTP, WEP, RC4 respectively). An unknowledgeable layman may misread what you wrote and think that OTP offers "perfect secrecy" in another sense of the word. Also, since you're broaching this topic some coverage of what a valid PNG/PRG key stretcher is would be helpful. |
|
2d |
revised |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? deleted 58 characters in body |
|
2d |
comment |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? @DeerHunter Someone under Witness Protection is something I'm less concerned about, but am more interested in understanding how much duplication could be seen in the worst case scenario. |
|
May 19 |
awarded | Nice Question |
|
May 18 |
comment |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? @SteveS The cost of a duplicate account per human would cost my company 10,000 to 100,000 per incident over the span of 10 years. I need to extrapolate this cost by possible transgressions. How much duplication (fraud) is possible with each assurance qualification? |
|
May 18 |
revised |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? edited title |
|
May 18 |
revised |
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? edited title |
|
May 18 |
asked | How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted? |
|
May 17 |
reviewed | Approve suggested edit on Unsolicited Password Request from Facebook |
|
May 17 |
reviewed | Approve suggested edit on Data Encryption and Key Management in C# |
|
May 16 |
awarded | Nice Question |
|
May 16 |
revised |
What can an attacker do with Bluetooth and how should it be mitigated? added 1 characters in body |
|
May 13 |
reviewed | Approve suggested edit on How to block an IP, if getting many http requests in a second |
|
May 12 |
comment |
RFC 6637: Algorithm-Specific Fields for ECDH Do you have a link to the source code? |
|
May 7 |
reviewed | Approve suggested edit on ROP Gadgets from executables? |
|
May 7 |
reviewed | Approve suggested edit on What access does UK Police currently have to ISP logs, and what information can said logs provide? |
|
May 7 |
reviewed | Approve suggested edit on How to fix SSL 2.0 and BEAST on IIS |
