17,622 reputation
981247
bio website lamontconsulting.com
location New York, NY
age 38
visits member for 3 years, 10 months
seen 10 hours ago

The following message is ROT26 encrypted:

SSL isn't good enough. Your website can be hacked.
Help solve the problem by advocating these RFCs:

TLSA (formerly DANE for DNS) Fixes the hackable CA problem

TLS-OBC: Fixes TLS, and the Related Domain Cookie Attack


About me


See ...my LinkedIn profile

Bitcoin: 1Ev4VoQYqZzJa1YvDCyUxFjpFhtK34evHk


Sep
17
comment How are Captive Wifi Portals secured?
@user10008 can't other users logged into the same ssid see , modify or replay data from others
Sep
17
comment How are Captive Wifi Portals secured?
@user10008 perhaps a ssl vpn would do the trick. I just want to authenticate users after they get a secure session
Aug
26
comment Does referrer header checking offer any real world security improvement?
Searching for your question in this site resulted in this answer: security.stackexchange.com/a/7984/396
Aug
16
comment Suspicious 2 page, no image Word Docx has 1.7 MB
Try uploading to VirusTotal...
Aug
16
comment Suspicious 2 page, no image Word Docx has 1.7 MB
I think fonts can be a virus vector...
Aug
14
comment What is the point of secure email gateways?
Whoops yes. BYOD
Aug
13
comment Does where I put my PKI certificates matter?
I've never fully understood the security implications of storing certs in different folders, though there are cases I've seen it matter (XBAP in Trusted Publishers for example)
Aug
13
comment Is there a secure way to create and distribute Shamir Secrets?
That is very cool, I'll be thinking about that for a bit.
Aug
13
comment Is there a secure way to create and distribute Shamir Secrets?
Oh and I assume that "collaborating private key owners recover the original plaintext" is where "plaintext" can equal a secret key
Aug
13
comment Is there a secure way to create and distribute Shamir Secrets?
I'll try to ask differently. If I have a secret X, when using the Shamir method, a person or trusted system must know X in order to split that secret. The Group method would encrypt X, but would also need a person or system that is trusted. My question is about dynamically composing a secret that no-one knows, and decrypting it. I don't think I'm crazy because these ECC keys have an additive property that provides secrecy. (regarding me being crazy - I'm definitely naive in crypto and respect the fact I have much to learn, might be way offtrack)
Aug
12
comment Is there a secure way to create and distribute Shamir Secrets?
If a group is used for asymmetric encryption, then that encrypting node needs to be trusted, right? Is there a way to eliminate that trust?
Aug
11
comment Authenticate WCF call to ADFS through Web Application Proxy (WAP)
The proxy has the ability to enable/disable different protocols for which it will proxy. Make sure this is enabled for your endpoint. That being said, I've never done this particular scenario before.
Aug
5
comment How is ZixCorp able to provide email encryption without a password?
Interesting... I don't see a zixvpm MX record for gmail or google. Most VPM integrations required this. I wonder what changed with the product.
Jul
31
comment Should SSL be terminated at a load balancer?
@TylerCollier thanks for your comments. I clarified.
Jul
31
comment Is there a secret-sharing public-key-encryption-based service?
Google "Portal Based Encryption"... there are many secure email portals that offload the key management and solves the issue that you're having.
Jul
30
comment Trust Issues Relative to Open Source
@IstvanChung - Thanks, was on a mobile device. Cut&Paste fail
Jul
29
comment How to trace AD Admin Login
Related: How to trace Admin file creation
Jul
26
comment Do multiplatform viruses exist?
Do XSS and Java / .NET exploits count?
Jul
24
comment Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?
(love the answer, esp the INAL part) Crazy question, in crypto, does negative zero exist?
Jul
21
comment What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?
The password portion is more for the scenario a user can't produce a ZKP. This can happen if they can't find their certificate/smart card or if they lose it at the bottom of the ocean. If they happen to find the smart card, (similar losing their keys and finding them again) I want to permit the user to unrevoke the certificate, but want to prevent a hostile user from doing so.