User Drew Lex

63 votes

5 answers

15k views

Is it common practice to log rejected passwords?

asked Jul 4, 2012 at 22:59

41 votes

2 answers

25k views

Salted hashes vs HMAC?

passwords hash password-management hmac algorithm

asked Jan 30, 2013 at 14:01

19 votes

4 answers

5k views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

cryptography public-key-infrastructure hardware hsm

asked Nov 27, 2012 at 5:45

9 votes

5 answers

6k views

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

encryption algorithm

asked Dec 12, 2012 at 18:44

8 votes

5 answers

905 views

Are we concentrating too much on password complexity?

passwords authentication password-management password-policy

asked Dec 20, 2012 at 5:38

6 votes

2 answers

2k views

What security standards and regulations are in place for bank ATM?

exploit integrity regulation non-repudiation

asked Jan 29, 2013 at 22:15

5 votes

2 answers

324 views

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

encryption tls wireless tunneling

asked Dec 20, 2012 at 11:20

5 votes

2 answers

203 views

What drives FIPS140-2 compliance?

compliance fips

asked Jun 30, 2012 at 1:47

5 votes

2 answers

2k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

tls protocols nist

asked Mar 22, 2013 at 16:44

3 votes

4 answers

2k views

If an ATM is stolen, how easy can the personal information of the users be recovered?

physical threat-mitigation countermeasure identity-theft atm

asked Mar 22, 2013 at 17:04

3 votes

1 answer

290 views

Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

fips

asked Jun 28, 2012 at 9:27

3 votes

3 answers

266 views

In what situations are web services required to protect confidentiality of user information?

web-application password-management compliance password-policy confidentiality

asked Jul 7, 2012 at 2:55

2 votes

1 answer

284 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

cryptography phone storage

asked Jul 5, 2012 at 11:31

2 votes

1 answer

250 views

How are AV scanners protecting against encrypted (PGPd) malicious code?

encryption pgp antivirus

asked Jun 30, 2012 at 1:59

2 votes

1 answer

4k views

Are banks required to be PCI compliant?

pci-dss credit-card

asked Jan 30, 2013 at 13:39

2 votes

1 answer

6k views

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

tls public-key-infrastructure key-management

asked Feb 28, 2013 at 20:21

2 votes

3 answers

198 views

Are mail-servers removed from security concerns in contrast with cloud storage?

email cloud-computing storage security-theater

asked Dec 20, 2012 at 5:25

1 vote

1 answer

122 views

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

compliance fips

asked Jun 29, 2012 at 19:42

0 votes

7 answers

4k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

passwords brute-force entropy passphrase

asked Jun 29, 2012 at 2:14

0 votes

2 answers

159 views

Security in the breaking cloud? Storage Wars?

legal cloud-computing confidentiality regulation

asked Dec 20, 2012 at 4:44

Stack Exchange Network

current community

your communities

more stack exchange communities

20 Questions

Is it common practice to log rejected passwords?

Salted hashes vs HMAC?

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

Is there an asymmetric encryption algorithm that maintains the length of the plaintext?

Are we concentrating too much on password complexity?

What security standards and regulations are in place for bank ATM?

If two endpoints establish a mutual authenticated connection (TLSv1.0) is the medium between the endpoints a concern?

What drives FIPS140-2 compliance?

Why is NIST removing & not updating TLS guidance? What is the replacement?

If an ATM is stolen, how easy can the personal information of the users be recovered?

Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

In what situations are web services required to protect confidentiality of user information?

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

How are AV scanners protecting against encrypted (PGPd) malicious code?

Are banks required to be PCI compliant?

What key sizes are allowed within TLS if the DHE_RSA is the only key exchange allowed?

Are mail-servers removed from security concerns in contrast with cloud storage?

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Security in the breaking cloud? Storage Wars?