sweis

23 ms·

1. 211.▲
   Cold boot attack against Android phones(www1.informatik.uni-erlangen.de)

   3 points by sweis 14y ago|0 comments
2. 212.▲
   by sweis 14y ago

   Are you recommending DDR3 memory because you think it's resistant to cold boot or reset attacks? That is not the case. DDR3 memory will not help you.
3. 213.▲
   by sweis 14y ago

   Yes, someone kindly edited my original submission title to remove the fact that this is a newly available free version of the book.
4. 214.▲
   Security Engineering – The Book(cl.cam.ac.uk)

   120 points by sweis 14y ago|12 comments
5. 215.▲
   by sweis 14y ago

   Here's a litmus test: If a user loses their credentials, is their data unrecoverable?
6. 216.▲
   Lessons Learned From Previous SSL/TLS Attacks(eprint.iacr.org)

   24 points by sweis 14y ago|3 comments
7. 217.▲
   A brief chronology of SSL/TLS attacks(armoredbarista.blogspot.de)

   2 points by sweis 14y ago|0 comments
8. 218.▲
   by sweis 14y ago

   Our model is that no hardware is trusted except the CPU and TPM. Plaintext data never leaves the CPU. All of main memory is encrypted, so it's beyond just protecting crypto keys in registers like TRESOR.
9. 219.▲
   by sweis 14y ago

   Shameless startup promotion here: PrivateCore (www.privatecore.com) is working on protecting against DMA and other memory extraction attacks, like non-volatile memory. Check out the attack device we implemented and how we defend against it:
10. 220.▲
    Google Application Security 0x0A List Hall of Fame(google.com)

    1 points by sweis 14y ago|0 comments
11. 221.▲
    by sweis 14y ago

    Think about availability. A large web site is going to keep replicated copies of data across many geographic locations, plus backed up in long term storage. Those data are stored in hardware that is continually coming in and out of service.
12. 222.▲
    by sweis 14y ago

    Shameless self-promotion here: PrivateCore ( http://www.privatecore.com ) defends against memory extraction attacks like this. We treat main memory as a hostile device and encrypt all data before it leaves the CPU. We're venture-backed and
13. 223.▲
    by sweis 14y ago

    IOMMU does not protect against non-volatile RAM or bus analyzers. Plus, "properly configured" is essential; most operating systems are not.
14. 224.▲
    by sweis 14y ago

    The Google Authenticator key length is truncated because of a usability tradeoff. Initially, a design goal was to allow people to manually type in keys on their device. This would be for cases where you couldn't scan a QR code, like when yo
15. 225.▲
    "Office Space" creator Mike Judge shooting new HBO parody of Silicon Valley(deadline.com)

    329 points by sweis 14y ago|115 comments
16. 226.▲
    Public Key Pinning Extension for HTTP(tools.ietf.org)

    2 points by sweis 14y ago|0 comments
17. 227.▲
    SFFT: Sparse Fast Fourier Transform(groups.csail.mit.edu)

    2 points by sweis 14y ago|0 comments
18. 228.▲
    by sweis 14y ago

    PrivateCore in Menlo Park, CA is looking for a full-time memory management researcher: http://www.privatecore.com/careers/memory-management-researc... Our secure hypervisor requires innovative solutions to challenging memory-management pr
19. 229.▲
    Linux Rootkit Doing iFrame Injections(securelist.com)

    3 points by sweis 14y ago|0 comments
20. 230.▲
    DMA Attacks and Defense with Full Memory Encryption [video](privatecore.com)

    2 points by sweis 14y ago|0 comments
21. 231.▲
    SSL Performance Case Study(insouciant.org)

    52 points by sweis 14y ago|1 comments
22. 232.▲
    by sweis 14y ago

    Here's a slide deck by Bellare talking about some of the differences between encrypt-and-MAC, MAC-then-encrypt, and encrypt-then-MAC: http://cseweb.ucsd.edu/~mihir/cse207/s-ae.pdf
23. 233.▲
    Web Cryptography API posted as W3C working draft(w3.org)

    64 points by sweis 14y ago|47 comments
24. 234.▲
    by sweis 14y ago

    I had never heard of TQP, but apparently they've sued hundreds of companies for violating an obscure crypto patent. They allege infringement just on the basis of using SSL / TLS. The defendants include Google, Adobe, the NFL, TD Ameritrade,
25. 235.▲
    TQP claims using SSL violates their crypto patent and sues hundreds of companies(cipherlawgroup.com)

    6 points by sweis 14y ago|1 comments
26. 236.▲
    by sweis 14y ago

    PrivateCore is hiring in Menlo Park, Ca. We're building a private computing platform that allows users safely use cloud computing resources without ceding control of their data. We're working on protecting from physical attacks: think reset
27. 237.▲
    by sweis 14y ago

    Is this thing using raw RSA with no padding? https://github.com/tarcieri/cryptosphere/blob/master/lib/cry...
28. 238.▲
    by sweis 14y ago

    There is the ability to protect memory from malicious devices with IOMMU, but it is often disabled by default. My experience with DMA attacks via Firewire or Thunderbolt is that they work out of the box. Inception is a nice tool to play wit
29. 239.▲
    PrivateCore: Another virtualization-enabled security solution launches(rationalsurvivability.com)

    1 points by sweis 14y ago|0 comments
30. 240.▲
    by sweis 14y ago

    We are looking for OS and security hackers. Contact us at jobs@privatecore.com or visit http://www.privatecore.com/careers.html for more info!