makerofthings7

12,849 reputation

332142

bio	website	lamontconsulting.com
	location	New York, NY
	age	36
visits	member for	2 years, 7 months
	seen	2 hours ago
stats	profile views	672

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack

About me
I have no relation to the above sites; I am just an advocate

Why "makerofthings7"? It's a challenge to "make seven things in my life of significant quality and value". Who knows if those things will take the form of software, art, or people. (I'm not married, no kids yet)

See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk

	12,849 reputation	bio	website	lamontconsulting.com	visits	member for	2 years, 7 months
332142 badges		location	New York, NY		seen	2 hours ago

summary answers questions tags badges favorites bounties reputation activity

681 Comments

suggestions reviews revisions comments badges posts accepts all

1d	comment	What ciphers should I use in my web server after I configure my SSL certificate? @D.W. I removed those entries
Jun 9	comment	Does hashing a PRNG make it cryptographically secure? Guessing the seeds to rand is probably the best way. What specifically are you looking at? Also think of part 2 as a tangent... and might be an additional way the PRNG could be attacked.
May 28	comment	How do I block LinkedIn from extracting data from Microsoft Exchange Server? I'm trying to figure out the command syntax for the commandlets to Permit MacOSX and deny others. Do you have any idea what this may be or is that best suited for serverfault?
May 28	comment	How do I block LinkedIn from extracting data from Microsoft Exchange Server? I will have to disagree with your understanding of what Web Services can do. I have written C# apps that use EWS, and Outlook for Mac uses EWS. Both have access to the inbox, and more frightenly the "notes" section of Contacts and Notes where 3rd party passwords are often stored.
May 21	comment	After How Much Data Encryption (AES-256) we should change key? Is it true that 3DES requires a key change at less than 0.5 MB?
May 21	comment	Is there a dictionary of visibly similar Unicode characters for Spam processing? @AJHenderson Good observation, and yes, even mixed locales would also be an indicator as well. I removed the English requirement to make this question useful to other people.
May 20	comment	Lessons learned and misconceptions regarding encryption and cryptology Note: A secure PRG is similar to a OTP. It is one that has all efficient statistical tests with a negligible result, and that it is impossible for a PRG to satisfy every theoretical statistical test. This "relaxing" of security is required for efficiency since "Perfect Secrecy" requires a secure transmission of an OTP big enough to match the the size of the message. EXAMPLE: All OTP transmissions require that the secret be transmitted securely (which is undefined how). It is more efficient to use that secure method to send the data in the first place.
May 20	comment	Lessons learned and misconceptions regarding encryption and cryptology Note: There is no message authentication in an OTP. Modifications to an OTP will be undetected.
May 20	comment	Lessons learned and misconceptions regarding encryption and cryptology This also opens the door for a Two time pad attack, that bit Microsoft PPTP. The first version of PPTP used the same key in the client and the server
May 20	comment	Lessons learned and misconceptions regarding encryption and cryptology Here is a right example: Suppose a crypto designer doesn't want to reuse the same key for multiple messages. One solution is to generate one key and expand it using a PRG. Then only use each multiple of `x` bits as a key. Where segment 1 == key 1, segment 2 == key 2.
May 20	comment	Lessons learned and misconceptions regarding encryption and cryptology Here is a wrong example: WEP implemented RC4 with a 24 bit nonce that increases after each message. This introduced two issues: (1) after 2^24 packets were sent, nonces were reused. (2) RC4 wasn't designed to have nonces "closely related" where it is known that each subsequent cipher was ++ the value of the previous.
May 20	comment	Lessons learned and misconceptions regarding encryption and cryptology Would you edit `"As I'm not reusing the key, there is no way to attack the ciphertext by subtracting one message from another."` and add text saying that other attacks are possible? EXAMPLE: a two time pad, bad protocol, or other bias (PPTP, WEP, RC4 respectively). An unknowledgeable layman may misread what you wrote and think that OTP offers "perfect secrecy" in another sense of the word. Also, since you're broaching this topic some coverage of what a valid PNG/PRG key stretcher is would be helpful.
May 19	comment	*How can I verify the identity of a US \| UK -based person and prevent fake identities* from being accepted?** @DeerHunter Someone under Witness Protection is something I'm less concerned about, but am more interested in understanding how much duplication could be seen in the worst case scenario.
May 18	comment	*How can I verify the identity of a US \| UK -based person and prevent fake identities* from being accepted?** @SteveS The cost of a duplicate account per human would cost my company 10,000 to 100,000 per incident over the span of 10 years. I need to extrapolate this cost by possible transgressions. How much duplication (fraud) is possible with each assurance qualification?
May 12	comment	RFC 6637: Algorithm-Specific Fields for ECDH Do you have a link to the source code?
May 5	comment	Why is it even possible to forge sender header in e-mail? -1 this is a misconception that SPF "fixes" this problem. SPF is limited in usefulness and reliability. More needs to be done.
Apr 22	comment	What are practical risks of http (not https) in server-to-server communications What if there was a private VPN or dedicated circuit in the B2B connection? (cc: also @Thomas Pornin)
Apr 17	comment	User Authentication API You should always use HTTPS not HTTP. Disallow HTTP use altogether
Apr 10	comment	What is the value in asking for a second password for sensitive operations? For assistance in defining what 2 factor actually is, readers may find this link helpful
Apr 10	comment	For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame? @Tedford Serverfault.com may be your best bet on this one.