User Drew Lex

63 votes

5 answers

15k views

Is it common practice to log rejected passwords?

asked Jul 4, 2012 at 22:59

41 votes

2 answers

28k views

Salted hashes vs HMAC?

asked Jan 30, 2013 at 14:01

20 votes

4 answers

5k views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

asked Nov 27, 2012 at 5:45

10 votes

5 answers

6k views

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

asked Dec 12, 2012 at 18:44

8 votes

5 answers

913 views

Are we concentrating too much on password complexity?

asked Dec 20, 2012 at 5:38

6 votes

2 answers

2k views

What security standards and regulations are in place for bank ATM?

asked Jan 29, 2013 at 22:15

5 votes

2 answers

331 views

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

asked Dec 20, 2012 at 11:20

5 votes

2 answers

207 views

What drives FIPS140-2 compliance?

asked Jun 30, 2012 at 1:47

5 votes

2 answers

2k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

asked Mar 22, 2013 at 16:44

3 votes

4 answers

2k views

If an ATM is stolen, how easy can the personal information of the users be recovered?

asked Mar 22, 2013 at 17:04

3 votes

1 answer

298 views

Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

asked Jun 28, 2012 at 9:27

3 votes

3 answers

270 views

In what situations are web services required to protect confidentiality of user information?

asked Jul 7, 2012 at 2:55

2 votes

1 answer

289 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

asked Jul 5, 2012 at 11:31

2 votes

1 answer

254 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

asked Jun 30, 2012 at 1:59

2 votes

1 answer

4k views

Are banks required to be PCI compliant?

asked Jan 30, 2013 at 13:39

2 votes

1 answer

6k views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

asked Feb 28, 2013 at 20:21

2 votes

3 answers

202 views

Are mail-servers removed from security concerns in contrast with cloud storage?

asked Dec 20, 2012 at 5:25

1 vote

1 answer

125 views

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

asked Jun 29, 2012 at 19:42

0 votes

7 answers

4k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

asked Jun 29, 2012 at 2:14

0 votes

2 answers

163 views

Security in the breaking cloud? Storage Wars?

asked Dec 20, 2012 at 4:44

Stack Exchange Network

20 Questions

Is it common practice to log rejected passwords?

Salted hashes vs HMAC?

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

Are we concentrating too much on password complexity?

What security standards and regulations are in place for bank ATM?

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

What drives FIPS140-2 compliance?

Why is NIST removing & not updating TLS guidance? What is the replacement?

If an ATM is stolen, how easy can the personal information of the users be recovered?

Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

In what situations are web services required to protect confidentiality of user information?

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

How are AV scanners protecting against encrypted (PGPd) malicious code?

Are banks required to be PCI compliant?

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Are mail-servers removed from security concerns in contrast with cloud storage?

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Security in the breaking cloud? Storage Wars?