16,573 reputation
861215
bio website lamontconsulting.com
location New York, NY
age 37
visits member for 3 years, 5 months
seen 10 hours ago

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack


About me
I have no relation to the above sites; I am just an advocate

Why "makerofthings7"? It's a challenge to "make seven things in my life of significant quality and value". Who knows if those things will take the form of software, art, or people. (I'm not married, no kids yet)

See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk


14h
comment How would I implement “Broadcast Encryption”?
Related crypto.stackexchange.com/q/1247/371
Apr
11
comment Does HTTPS retrieval, among its other effects, sign a document?
IP address "signing" is of weak utility. If the "ownership" of the IP address comes into question, the whole signing scheme falls apart. Creative, but bad idea
Apr
10
comment How to explain Heartbleed without technical terms?
Heartbleed allows an attacker to anonymously download a random chunk of memory of the server. This means they can get unencrypted passwords, and low-level encryption keys that protect your account... not to mention that an attacker might be able to access any part of the website (or data that you post into that site)
Mar
27
comment Are there any systems out there that use a one-time pad?
@jarnbjo You're right but I didn't get into that use case. Is there a word to describe that early transfer of an OTP secret for pending, future use by one or more messages?
Mar
26
comment How does data.stackexchange.com allow queries securely?
If you're using Windows, you can expose your data with ODATA (Microsoft WCF) and set filters to dynamically alter or throttle inbound queries.
Mar
19
comment Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?
Can a given implementation set A or even P to null? And use AES GCM just for integrity? or is that a bad practice?
Mar
19
comment Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?
Thank you. Also, I found T ... it was computed internally by Bouncy Castle and appended to the end of C. I suppose that all Bouncy-based code serializes in this order.
Mar
19
comment Is there a widely used protocol which builds on AES/GCM, and defines serialization formats of A, IV, C and T together?
For those interested in the non-random key, the source is here ; please direct violence to that link ;) (or a Git pull request)
Mar
18
comment How would I implement “Broadcast Encryption”?
Is it correct that for a 1024 bit RSA key, the maximum size of a symmetric key I can use is 117 bytes?
Mar
11
comment How secure is Samy Kamkar's Anti-MITMA Diffie-Hellman Key Exchange Technique?
move to crypto.SE?
Mar
10
comment Is this where a nonce comes into play?
A userID should not act as a bearer token. Bearer tokens for web api access should have an expiration, different each time they log in, and different for each user. A bearer token shouldn't contain the User id directly in it, however the server should know how to determine the userID from a given token.
Mar
10
comment What are the benefits to a two-page login system for a webapp?
@Warren, yes that's probably Sitekey. Read about it here security.stackexchange.com/q/26347/396
Feb
18
comment Why does the RFC 5280 dictate the CAs not to issue certificates with negative serial numbers?
Please see this answer regarding why serial numbers should be random security.stackexchange.com/q/15690/396
Feb
4
comment Describe an example of indistinguishability obfuscation or functional encryption
In other words, could this technology enable an Agent as described here: en.bitcoin.it/wiki/Agents
Feb
4
comment Describe an example of indistinguishability obfuscation or functional encryption
When I read this I wondered if I could use this to store the private key of a Bitcoin wallet so that an autonomous app could "pays"/signs from that wallet to a benefactor based on certain provable and fixed conditions? (Assuming those conditions are within the block chain itself)
Feb
2
comment What useful things can I do with the html5 “keygen” element?
See also: Pros and Cons of the Keygen element
Feb
1
comment How to Protect JSON Data
If you're talking about Javascript attacks, the answer to your question is here: stackoverflow.com/q/3146798/328397 I'd post as an answer but this question is on hold
Jan
17
comment Why are OSX users of my TLS-only site being asked to supply a client certificate?
yes, open a ticket with them.
Jan
17
comment Why are OSX users of my TLS-only site being asked to supply a client certificate?
Almost all client certificate UI's are horrible. Perhaps you're behind a load balancer or your firewall has a broken reverse NAT, where it's shuffling traffic between many hosts.
Dec
11
comment How secure are the new TLDs ( .us, .io, …) and do they compare to .com?
@paj28 SSL can be hacked if the CA is hacked (which has been done before), and also in my way if keys are stored in DNS