5 ms·

I would be hesitant to trust any cryptographic implementation coming from browser JavaScript. It’s not that I doubt or don’t trust the implementations from the

I would be hesitant to trust any cryptographic implementation coming from browser JavaScript. It’s not that I doubt or don’t trust the implementations from the browser vendors. I don’t trust the JavaScript developers executing them. This will provide a false sense of security implemented by persons lacking the education, training, and experience in security. Most software developers generally are not formally trained in security as a separate domain of knowledge. If you think security is something that can be passively acquired by reading a few APIs you are wrong. This is why employers require certifications for security work that software development otherwise doesn’t require. Cryptography was one of the most challenging domains/chapters in preparation for the CISSP. This is because real world cryptography implementations comprise various different cryptographic functions doing different things, such as: certificates, encryption, signatures, hashing, and so forth. The different crypto functions serve different purposes because they have different pros and cons. There isn’t some encryption blanket solution.

kenniskrag 6y ago
Can you recommend resources to learn security? Passed 3 security modules at my university and it feels like I know not much about secure engineering.
- austincheney 6y ago
  Study first for the Security+ exam. That is the entry level security certification. It is much harder now than it used to be. You can find a lot of books and study material about it online. The gold standard is still CISSP for the corporate world. It is more of a managerial standard. The best study guide is the official course book: https://www.amazon.com/Certified-Information-Security-Professional-Official-ebook/dp/B07CG86947/ref=mp_s_a_1_4?dchild=1&keywords=cissp+coursebook&qid=1619696728&sr=8-4 https://www.amazon.com/Certified-Information-Security-Profes... https://en.m.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional https://en.m.wikipedia.org/wiki/Certified_Information_System... The standard most prized by government and security researchers is GIAC from Sans. https://en.m.wikipedia.org/wiki/Global_Information_Assurance_Certification https://en.m.wikipedia.org/wiki/Global_Information_Assurance... To take the CISSP you have to apply for the exam because there are prerequisite criteria and the exam costs $700. Even still it only has around a 60% pass rate. The GIAC tests are supposed to be much harder and are extremely expensive. I passed the CISSP but have never taken any of the GIAC tests.
  - mhluongo 6y ago
    They asked for learning resources, not paid certifications most of us ignore on CVs.
    - austincheney 6y ago
      That’s because you are a developer and not a security manager.
      - not1ofU 6y ago
        https://www.youtube.com/watch?v=ZdGrC9S4PYA https://www.youtube.com/watch?v=ZdGrC9S4PYA
      - bawolff 6y ago
        CISSP has a somewhat positive reputation, but lots of the other certs are basically negative signal on a resume. There's lots of different types of security stuff. If you're interested in the more risk management corporate side, looking at study material for certs like CISSP can be useful (but use it as a starting point of things to learn, dont follow blindly). If you want to learn crypto, that's not the path i would reccomend.
        austincheney 6y ago
        The software industry does not value certifications... at all. The networking and security industries, on the other hand, require them. Attaining those jobs/skills from the perspective of writing software is the surest way to waste your time and accomplish nothing.
      - mhluongo 6y ago
        The ask was "secure engineering", yeah? The auditors and pentesters we hire have never presented me with their certificates ¯\_(ツ)_/¯ > That’s because you are a developer and not a security manager These days, I'm neither.. but I am a founder in a security-critical space.
- not1ofU 6y ago
  For CISSP specifically, search for anything by "Shon Harris" Here are a collection of links that I have, YMMV (theres probably a some overlap in these links): https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYEqNB01EDbCjLy https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYE... https://simonowens157.gitlab.io/cissp/ https://simonowens157.gitlab.io/cissp/ https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkUUId6PKW0fpJdBRJO5MFQ8VM https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkU... https://github.com/ericagleaton/CISSP-2 https://github.com/ericagleaton/CISSP-2 https://github.com/gatlindada/cissp-mind-map https://github.com/gatlindada/cissp-mind-map https://github.com/TheRealBenForce/cissp-mnemonics https://github.com/TheRealBenForce/cissp-mnemonics https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJXGqyHGb0Xsbr https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJ... https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeEFEGJTeDVGr4X https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeE... https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZHKcqXZUIdXqZI https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZH... If you have access to linkedin learning, there are a number of decent resources there also. EDIT: unrelated to ^, Checkout youtuber "Ippsec" - he does hack the box challenges (retired boxes).
  - not1ofU 6y ago
    EDIT 2: This is also really great, very recent talk. https://www.youtube.com/watch?v=v1Qt_YYtBoM https://www.youtube.com/watch?v=v1Qt_YYtBoM Speakers Site and slides used for ^ https://momjian.us/main/writings/crypto.pdf https://momjian.us/main/writings/crypto.pdf For those who dont want to click on PDF (Good stuff) link to site: https://momjian.us/main/ https://momjian.us/main/ Bruce Momjian is a legend.
- q3k 6y ago
  For cryptographic primitives, some of the theory behind them, their practical use and what can go wrong when you fuck things up, 'Serious Cryptography' (https://nostarch.com/seriouscrypto https://nostarch.com/seriouscrypto) is a good book.
- bawolff 6y ago
  "Security" is a broad concept encompassing many things. You might want to figure out what you want to learn. If you want to learn more about crypto, there's various books (not sure how up to date , but https://www.goodreads.com/book/show/7602360-cryptography-engineering https://www.goodreads.com/book/show/7602360-cryptography-eng... is a good introduction) https://cryptopals.com/ https://cryptopals.com/ is also good if you like hands on.

kenniskrag 6y ago

Can you recommend resources to learn security? Passed 3 security modules at my university and it feels like I know not much about secure engineering.

austincheney 6y ago
Study first for the Security+ exam. That is the entry level security certification. It is much harder now than it used to be. You can find a lot of books and study material about it online. The gold standard is still CISSP for the corporate world. It is more of a managerial standard. The best study guide is the official course book: https://www.amazon.com/Certified-Information-Security-Professional-Official-ebook/dp/B07CG86947/ref=mp_s_a_1_4?dchild=1&keywords=cissp+coursebook&qid=1619696728&sr=8-4 https://www.amazon.com/Certified-Information-Security-Profes... https://en.m.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional https://en.m.wikipedia.org/wiki/Certified_Information_System... The standard most prized by government and security researchers is GIAC from Sans. https://en.m.wikipedia.org/wiki/Global_Information_Assurance_Certification https://en.m.wikipedia.org/wiki/Global_Information_Assurance... To take the CISSP you have to apply for the exam because there are prerequisite criteria and the exam costs $700. Even still it only has around a 60% pass rate. The GIAC tests are supposed to be much harder and are extremely expensive. I passed the CISSP but have never taken any of the GIAC tests.
- mhluongo 6y ago
  They asked for learning resources, not paid certifications most of us ignore on CVs.
  - austincheney 6y ago
    That’s because you are a developer and not a security manager.
    - not1ofU 6y ago
      https://www.youtube.com/watch?v=ZdGrC9S4PYA https://www.youtube.com/watch?v=ZdGrC9S4PYA
    - bawolff 6y ago
      CISSP has a somewhat positive reputation, but lots of the other certs are basically negative signal on a resume. There's lots of different types of security stuff. If you're interested in the more risk management corporate side, looking at study material for certs like CISSP can be useful (but use it as a starting point of things to learn, dont follow blindly). If you want to learn crypto, that's not the path i would reccomend.
      - austincheney 6y ago
        The software industry does not value certifications... at all. The networking and security industries, on the other hand, require them. Attaining those jobs/skills from the perspective of writing software is the surest way to waste your time and accomplish nothing.
    - mhluongo 6y ago
      The ask was "secure engineering", yeah? The auditors and pentesters we hire have never presented me with their certificates ¯\_(ツ)_/¯ > That’s because you are a developer and not a security manager These days, I'm neither.. but I am a founder in a security-critical space.
not1ofU 6y ago
For CISSP specifically, search for anything by "Shon Harris" Here are a collection of links that I have, YMMV (theres probably a some overlap in these links): https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYEqNB01EDbCjLy https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYE... https://simonowens157.gitlab.io/cissp/ https://simonowens157.gitlab.io/cissp/ https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkUUId6PKW0fpJdBRJO5MFQ8VM https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkU... https://github.com/ericagleaton/CISSP-2 https://github.com/ericagleaton/CISSP-2 https://github.com/gatlindada/cissp-mind-map https://github.com/gatlindada/cissp-mind-map https://github.com/TheRealBenForce/cissp-mnemonics https://github.com/TheRealBenForce/cissp-mnemonics https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJXGqyHGb0Xsbr https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJ... https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeEFEGJTeDVGr4X https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeE... https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZHKcqXZUIdXqZI https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZH... If you have access to linkedin learning, there are a number of decent resources there also. EDIT: unrelated to ^, Checkout youtuber "Ippsec" - he does hack the box challenges (retired boxes).
- not1ofU 6y ago
  EDIT 2: This is also really great, very recent talk. https://www.youtube.com/watch?v=v1Qt_YYtBoM https://www.youtube.com/watch?v=v1Qt_YYtBoM Speakers Site and slides used for ^ https://momjian.us/main/writings/crypto.pdf https://momjian.us/main/writings/crypto.pdf For those who dont want to click on PDF (Good stuff) link to site: https://momjian.us/main/ https://momjian.us/main/ Bruce Momjian is a legend.
q3k 6y ago
For cryptographic primitives, some of the theory behind them, their practical use and what can go wrong when you fuck things up, 'Serious Cryptography' (https://nostarch.com/seriouscrypto https://nostarch.com/seriouscrypto) is a good book.
bawolff 6y ago
"Security" is a broad concept encompassing many things. You might want to figure out what you want to learn. If you want to learn more about crypto, there's various books (not sure how up to date , but https://www.goodreads.com/book/show/7602360-cryptography-engineering https://www.goodreads.com/book/show/7602360-cryptography-eng... is a good introduction) https://cryptopals.com/ https://cryptopals.com/ is also good if you like hands on.