sweis

25 ms·

241.
PrivateCore nets $2.25M to build a hardened hypervisor(gigaom.com)
3 points by sweis 14y ago|1 comments
242.
by sweis 14y ago
Some nits about your encrypted API: 1. The ciphertext is not authenticated. You should MAC it. 2. The plaintext is padded with spaces to be block-aligned. "Hello world" will collide with "Hello world_" when encrypted with the same IV, and b
243.
by sweis 14y ago
Matthew Green from Johns Hopkins has a great crypto blog. This summarizes some of his posts.
244.
Synopsis of "Cryptography Engineering" blog posts(blog.cryptographyengineering.com)
1 points by sweis 14y ago|1 comments
245.
by sweis 14y ago
Yes and no. There are some solutions out there, but they are typically not ready for production, require custom hardware, or make assumptions about physical security controls. (Disclaimer: I am biased since I am working on this.)
246.
by sweis 14y ago
The TPM does not provide full memory protection. TPMs are primarily used to attest the state of running software. It does not prevent someone from reading memory contents.
247.
by sweis 14y ago
Widespread adoption of NVRAM may require a significant change in security models, since data once assumed ephemeral may be persistent. For example, it may be trivial to recover cryptographic keys from a running system. (Disclaimer: I'm work
248.
by sweis 14y ago
PrivateCore is developing a product to defend against physical attacks, including cold boot and DMA: http://www.privatecore.com . We offer stronger security guarantees than what TRESOR can provide. However, we are currently targeted towar
249.
by sweis 14y ago
If you are in the US, the FCC will allow unlicensed devices operate on the TV whitespace spectrum. However, in order to avoid interfering with existing devices that use the same frequencies there will be a database of available frequencies
250.
Quantum Money from Hidden Subspaces(eprint.iacr.org)
1 points by sweis 15y ago|0 comments
251.
by sweis 15y ago
I just gave it a quick scan and found some issues: 1. PKCS1 verification looks vulnerable to a timing attack. 2. They're using plain RSA to encrypt message data without any padding like OAEP. This is not semantically secure. 3. They are no
252.
by sweis 15y ago
The description doesn't mention him by name, but does say: The class will be taught by entrepreneurs who have started companies worth over $1B and VCs who have invested in startups including Facebook and Spotify I read on a unrelated emai
253.
Peter Thiel possibly teaching "Startup" CS 183 at Stanford(explorecourses.stanford.edu)
2 points by sweis 15y ago|1 comments
254.
Format string vulnerability found in 'sudo'(sudo.ws)
171 points by sweis 15y ago|32 comments
255.
by sweis 15y ago
I've seen at least three independent implementations of this idea. One is called Snap2Pass: http://prpl.stanford.edu/papers/soups10j.pdf http://www.youtube.com/watch?v=-9QOcDV4VZI Here's one called Animate Login with source code: http:
256.
by sweis 15y ago
"hash - An MD5 hash value made of the concatenation of YOUR_APPLICATION_KEY + EMAIL + CODE" Stop using unsafe keyed hashes: http://rdist.root.org/2009/10/29/stop-using-unsafe-keyed-has... That's a red flag that these guys don't know what
257.
by sweis 15y ago
This is a paper proposing a privacy-enhanced version of a Twitter-like service. They also built a working browser extension and server prototype.
258.
Hummingbird: Privacy in the time of Twitter(eprint.iacr.org)
2 points by sweis 15y ago|1 comments
259.
by sweis 15y ago
Hi. I'm doing some research into security practices on public cloud infrastructures (e.g. AWS, Linode, Heroku). Specifically, I'm interested if and how people deploy credentials and handle sensitive data. Please take a minute to fill it out
260.
Public Cloud Security Survey(saweis.net)
1 points by sweis 15y ago|1 comments
261.
by sweis 15y ago
This is cool. I'd also like to point out the PAM module: http://code.google.com/p/google-authenticator/source/browse/...
262.
Can a Program Reverse-Engineer Itself?(eprint.iacr.org)
2 points by sweis 15y ago|0 comments
263.
Can Quantum Machines Do It All?(rjlipton.wordpress.com)
2 points by sweis 15y ago|0 comments
264.
by sweis 15y ago
I tried to password-protect the page in question. It may not be working properly.
265.
by sweis 15y ago
Well, that makes the XSS vulnerability kind of moot.
266.
by sweis 15y ago
Howdy. I think this is vulnerable to cross-site scripting. For example: http://deadsimple.me/foobar/
267.
Why Philosophers Should Care About Computational Complexity(scottaaronson.com)
140 points by sweis 15y ago|36 comments
268.
by sweis 15y ago
Note that besides sending codes via SMS, Google's two-factor authentication also supports time-based one-time passcodes (TOTP) that can be generated from a mobile device. They also support a list of one-time printable codes. I kept a couple
269.
by sweis 15y ago
This implementation is broken. It concatenates a hash of the plaintext to a CTR-mode ciphertext. That's weakly authenticated and leaks information about the plaintext. It would be better to HMAC the ciphertext with a second key value.
270.
by sweis 15y ago
Google supports HOTP-based codes that can be generated by a mobile application or even a local bookmarklet. They also support printed one-time codes. Here's the open source project for the mobile app and PAM module: http://code.google.com/

More ›