meta user
network profile
| bio | website | lamontconsulting.com |
|---|---|---|
| location | New York, NY | |
| age | 36 | |
| visits | member for | 2 years, 6 months |
| seen | 1 hour ago | |
| stats | profile views | 635 |
The following message is ROT26 encrypted:
SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:
TLSA (formerly DANE for DNS) Fixes the hackable CA problem
TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack
About me
I have no relation to the above sites; I am just an advocate
Why "makerofthings7"? It's a challenge to "make seven things in my life of significant quality and value". Who knows if those things will take the form of software, art, or people. (I'm not married, no kids yet)
See ...my LinkedIn profile
Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk
|
Mar 18 |
reviewed | Edit suggested edit on Is this an example of XSS attack? |
|
Mar 18 |
revised |
Is this an example of XSS attack? edited offensive example URL (Thank you @Tidalwave) |
|
Mar 18 |
comment |
Anonymized Votes ... also AES != UProve |
|
Mar 18 |
comment |
Anonymized Votes @DaveJarvis see why javascript crypto is a bad idea |
|
Mar 18 |
answered | Anonymized Votes |
|
Mar 16 |
awarded | Nice Answer |
|
Mar 16 |
comment |
User friendly PGP email From the makers of PGP: silentcircle.com/web/silent-mail/# |
|
Mar 16 |
comment |
How to support secure creation of a user account over an external API via a queued job? @titanous You're very correct. I used the words "seed and hash" in every revision of my answer, but illustrated an algorithm that didn't do that. I remember changing my mind 1/2 way though thinking "it's not that important for a temporary queue to have seeding and hashing" mainly thinking that the number of bits created by that would be too long. But this is a question (how do I truncate or shorten a hashed pw) for Thomas Pornin. |
|
Mar 15 |
comment |
How to support secure creation of a user account over an external API via a queued job? @titanous I agree one shouldn't invent their own crypto. But why is it a bad idea to hash a password before sending it to a 3rd party API? As long as it meets length and complexity limitations I think thats' a fine thing to do. bcrypt/scrypt/pbkdf2 are meant for the offline database file. They create LONG passwords that may be truncated or refused at the 3rd party. RIPEMD creates a small hash that should fit. |
|
Mar 15 |
revised |
How to support secure creation of a user account over an external API via a queued job? deleted 173 characters in body |
|
Mar 15 |
revised |
Are smartphones at least as safe as “regular” computers for personal data? spell check likely altered this to "violently" when you really meant vehemently ;) |
|
Mar 14 |
reviewed | Reject suggested edit on webserver tag wiki |
|
Mar 14 |
revised |
Is there multi-factor authentication for machines? edited tags |
|
Mar 14 |
comment |
Is there multi-factor authentication for machines? I suppose multi-factor for services & background processes would be relevant here as well. |
|
Mar 14 |
awarded | Enlightened |
|
Mar 14 |
awarded | Nice Answer |
|
Mar 14 |
comment |
Can double encryption with different key increase the security? Will double encryption increase the security of cipher vs bruteforce? |
|
Mar 14 |
comment |
Can double encryption with different key increase the security? For those interested, here is the link to the chat archive Lots of useful or interesting information there |
|
Mar 14 |
comment |
Can double encryption with different key increase the security? @Iszi You're right, and given extra thought about this, I think that using different keys would more security if those keys are given to two different people (etc). Security depends on key management. But the real answer should be "if your computer will be performing X amount of computational power, and using two keys = 2x, and you don't need two keys, you're better off making the key length longer". Pornin has something similar here but I can't find it. |
|
Mar 14 |
comment |
Does the padlock on my browser really indicate a reasonable assurance against eavesdropping? See this fantastic answer regarding desktop browsers |
