19,092 reputation
1591266
bio website lamontconsulting.com
location New York, NY
age 38
visits member for 4 years, 1 month
seen 1 min ago

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack


About me


See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk


Dec
17
comment Deterring Mobile phone Tethering in the workplace
fyi - Blocking USB isn't the answer, I can tether my MacBook with an iPad over Bluetooth
Dec
16
comment Are there theoretical attacks against ECC Digital Signatures?
I love reading your answers.
Dec
16
comment Distance between two passwords
@Curious - If you want to include an additional, non-standard, non scientific vector, you need to add that yourself (perhaps in the private information parse stage. L33t-speak counts as non public/standard info that you will need to parse, bifurcate, and and test the permutations
Dec
14
comment Do website owners know what keywords a visitor typed in google search to get to their site?
With respect to privacy, I believe this is on topic.
Dec
12
comment How do I release a self made program without it being tracked back to me?
if you're making an iOS app, I think it requires a certificate, so you must be talking about Android and possibly Windows Phone (or Blackberry)
Dec
6
comment How does IPsec turn KEYMAT into Encryption and Authentication Keys?
+1 Very well thought out question.
Dec
4
comment Certificates - What about signing again Intermediate CA certificates?
YEs, nothing to reissue, because they are already trusted
Dec
3
comment What prevents “money card” (offline smartcard system) from getting duplicated for payment fraud?
Posting this to validate the question as worthy to be asked: Some stored value cards actually store the value on the card itself. Here is an example where the protocol (to deduct the value) is insecure, and the "deduct payment" instruction is hidden youtube.com/watch?v=vZ4MqMUO5NY
Nov
22
comment Is it possible to modify the last time a user logged into Windows?
The old event log was numbered sequentially internally so this would be detectable. Does the new event log write events in date time order, or last written?
Nov
21
comment Is it possible to modify the last time a user logged into Windows?
One way - look at the last modified (or acccess) time of the user's local profile
Nov
21
comment Does Wifi encryption create a private tunnel between the adapter and the accesspoint?
@DavidFoerster - Edited to be more clear
Nov
21
comment How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
Costs: different authentication + encryption costs different amounts. It may or may not require hardware replacements. Support will cost more no doubt. Risks: Anything not encrypted over SSL/HTTPS can potentially be seen. Is this a problem? depends on the content. If your internal sites (Blackboard) don't use SSL, then that is a problem.
Nov
21
comment How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
@AaronRosenfeld I know first hand that most Universities are willing or eager to discuss their experiences, wants and desires with other schools. Community colleges are different, if they have the staff, depth of technical knowledge, and time, they too will freely share designs that work.
Nov
10
comment How bad is it to truncate a hash?
Is it conceivable that one could build a chart listing "safe, unsafe, and 'easy'" for truncating a hash of various lengths? I'm imagining one chart for preimage, second preimage, and one for collisions. I would be interested if the security increase is relatively the same per characteristic
Nov
8
comment Continued Use of Kerberos
What Authentication protocol is "better" than Kerberos from a technical perspective?
Nov
2
comment Continued Use of Kerberos
For perspective, almost all Windows / Active Directory networks use Kerberos, albeit a MSFT implementation
Oct
23
comment Has a plaintext password ever been used in a court of law as evidence to a crime?
Related Is there any legal reason to save a cleartext password?
Oct
21
comment Which graphic image formats contain revision history? Does the image editing software being used matter?
How to uncover blurred information in photographs
Oct
15
comment Based on these email headers, where is this virus coming from?
Yes, I did anonymise the headers slightly. Those were internal and or known hosts. @Dogeatcatworld
Sep
23
comment Server situated on two physical networks - Bad idea or not
Question for you - If you had an ESX farm, would you allow a DMZ host to be VLANd on the same farm as non DMZ equipment?