sweis

52 ms·

1. 181.▲
   by sweis 13y ago

   I've seen client-side certificates work in large organizations (e.g. MIT). However, this was in the pre-smartphone era. They just had to support IE, Safari, and Firefox. That was still a pain. Today, it's much harder to support ev
2. 182.▲
   "Engineering Security" by Peter Guttman book draft (2013)(cs.auckland.ac.nz)

   1 points by sweis 13y ago|0 comments
3. 183.▲
   by sweis 13y ago

   For some background, Intel issues SINIT authenticated code modules (ACMs) which are used for the trusted boot process. According to this advisory, these modules are vulnerable to a privilege escalation attack which could compromise system m
4. 184.▲
   Intel Trusted Execution Technology (TXT) privilege escalation vulnerability(security-center.intel.com)

   10 points by sweis 13y ago|1 comments
5. 185.▲
   by sweis 13y ago

   The gist is that encrypting and authenticating main memory still leaves you vulnerable to memory access traffic analysis. This is analogous to the NSA seeing metadata on phone and email traffic. ORAM makes those accesses oblivious to someon
6. 186.▲
   MIT Ascend oblivious RAM prevents memory access pattern leakage(web.mit.edu)

   3 points by sweis 13y ago|1 comments
7. 187.▲
   The SIMON and SPECK Families of Lightweight Block Ciphers(eprint.iacr.org)

   46 points by sweis 13y ago|45 comments
8. 188.▲
   by sweis 13y ago

   Actually, yes you can. Check out identity-based encryption and Voltage Security. It's currently in use by Wells Fargo, ADP, and other large enterprise customers. The catch there is that IBE requires a centralized, trusted key-issuing s
9. 189.▲
   by sweis 13y ago

   Very cool. Looking forward to hearing about CloudFlare's solution.
10. 190.▲
    by sweis 13y ago

    I think CDNs make the best effort with the tools they have. However, many PoPs don't have locked racks, biometrics, or cameras. This means CDNs are limited to where they can safely terminate SSL connections, which impacts latency and u
11. 191.▲
    by sweis 13y ago

    If you're terminating SSL in the edge network of CloudFlare or other CDNs, then your private key is going to be replicated to all their points of presence. Keys will be vulnerable to anyone with access to those PoPs, which are generall
12. 192.▲
    by sweis 13y ago

    As far as I can tell, this is using CBC mode without any authentication: https://raw.github.com/mdp/gibberish-aes/master/dist/gibberi... If that's the case, then this implementation is vulnerable to
13. 193.▲
    by sweis 13y ago

    This is a collection of resources about physical memory attacks and defenses, e.g. cold boot, TRESOR, DMA attacks, etc.
14. 194.▲
    Physical memory attack and defense resources(privatecore.com)

    2 points by sweis 13y ago|1 comments
15. 195.▲
    Wi-Vi: See Through Walls with Wi-Fi Signals(people.csail.mit.edu)

    3 points by sweis 13y ago|0 comments
16. 196.▲
    by sweis 13y ago

    I've seen web frontends that encrypt submitted credit card info with a public key, then had billing backends that re-encrypted with a symmetric key (usually in a HSM). That was strictly for performance overhead and key rotation flexibility.
17. 197.▲
    by sweis 13y ago

    "For the techies who are wondering, the encryption on the credit card information is 4096 bit RSA." Why would they be using RSA to encrypt fields in an internal database, rather than a symmetric algorithm? If they really did use RSA, I'd wa
18. 198.▲
    by sweis 13y ago

    It's not a big surprise that they didn't overreact. Billy Rios has a long relationship with Google. He worked there for almost 3 years: http://www.linkedin.com/pub/billy-rios/3/a7a/5b1 Before that, he was recognized for "ongoing and susta
19. 199.▲
    NandX: Hiding and finding data with NAND flash error codes(github.com)

    2 points by sweis 14y ago|0 comments
20. 200.▲
    by sweis 14y ago

    "Nightweb starts its life by generating a DSA-SHA1 key pair" Just a note for the authors, as of 2010 NIST recommends not using SHA-1 for new digital signature generation and "disallows after 2013". See section 9 here: http://csrc.nist.gov/
21. 201.▲
    AES cache-timing attacks viable on phones(eprint.iacr.org)

    1 points by sweis 14y ago|0 comments
22. 202.▲
    "Cryptography Worst Practices" slides by djb(cr.yp.to)

    2 points by sweis 14y ago|0 comments
23. 203.▲
    by sweis 14y ago

    For the record, Google Authenticator has always been open source and is based on open HOTP and TOTP standards. You could always add arbitrary accounts to the mobile app using the key URI format: https://code.google.com/p/google-authenticat
24. 204.▲
    by sweis 14y ago

    Another session of Dan Boneh's online crypto course starts up tomorrow.
25. 205.▲
    New session of Stanford's online crypto course by Dan Boneh(coursera.org)

    1 points by sweis 14y ago|1 comments
26. 206.▲
    by sweis 14y ago

    Congratulations! Best of luck.
27. 207.▲
    by sweis 14y ago

    This is appearing in the upcoming IEEE S&P conference: http://www.ieee-security.org/TC/SP2013/program.html
28. 208.▲
    PrivExec: Private Execution as an Operating System Service(seclab.ccs.neu.edu)

    1 points by sweis 14y ago|1 comments
29. 209.▲
    by sweis 14y ago

    Keyczar has support for Java, Python, and C++ and uses the usual suspect standardized algorithms: AES, RSA, DSA, HMAC-SHA1. Google has been pretty active in maintaining Keyczar lately. ECC support should be added at some point. As bascule s
30. 210.▲
    by sweis 14y ago

    No, this is not true. I think Evernote has been misinformed. If all you are doing is encrypting data with a standard algorithm, it takes less than 30 minutes to fill out the paperwork to get an encryption registration number (ERN). Total tu