back
user profile

rietta

2,551karma·712submissions·October 29, 2012
about
Building and breaking applications for 26+ years. MS in Cyber Security (formerly InfoSec, GaTech). Focused on practical security controls to prevent breaches. Lifetime OWASP.

Website: https://rietta.com/ Blog: https://rietta.com/blog/

[ my public key: https://keybase.io/rietta; my proof: https://keybase.io/rietta/sigs/uk2sEk4_TfZeNJ8ZwJN7VF1Ub-aLW_l8clAq-EbQ578 ]

recent activity (712 total)
comment
Dump a few hundred megabytes from /dev/random into an encrypted file with a provocative name. The thing every Cypherpunk dreams about.
10y ago·view thread
comment
This article is an overly simplified threat model is just the most basic explanation on the issues as they would play out in a world with only good guys and where no keys or credentials are stolen or …
10y ago·view thread
comment
Even with absolutely perfect systems, which do not exist in practice even when they may exist in math, the humans with the keys are the weakest link. Stolen credentials are the biggest cause of data b…
10y ago·view thread
comment
Even if the system were perfect and the users with legit access had impeccable credential management and physical security, the escrow will be used a lot to unlock devices and communications. It bec…
10y ago·view thread
comment
And what if government agencies bought that safe to handle classified material because it was certified to have met or exceeded the standards for handling such data. Then the FBI forces the safe manuf…
10y ago·view thread
comment
I do understand what you are saying and it is precisely because of Director Comey's public statements on the matter that I called him an expert statesman in the article, which he is. The legal pr…
10y ago·view thread
comment
It has been explained to them multiple times in congressional hearings. If you have a long time, the recent House Judiciary Committee Hearing is worth the watch: The Encryption Tightrope: Balancing Am…
10y ago·view thread
comment
I'll take this a step further. Ultimately Director James Comey and the FBI want a future where it is illegal or impractical to deploy strong encryption without key escrow. Few companies, actually…
10y ago·view thread
comment
In a clause is contrary to public policy, it may be unenforceable in that jurisdiction and thus they could use the code without violating the license. The unenforceable clause will be skipped over by…
10y ago·view thread
comment
Absolutely true! I have to tell people that many attacks just try every door to see if its unlocked. They are not movie plot-style targeted attacks. And such an attack can and do lead to data breaches…
10y ago·view thread
comment
This is why I absolutely believe and publicly talk about security being a matter of developer ethics. I have used my walk away power to get a company to do the security they needed in a similar, but…
10y ago·view thread
comment
Seems that the site has been slashdotted (or is that Hacker Newsed) - "Error establishing a database connection".
10y ago·view thread
comment
Not entirely. The companies that must collect presumably have better security safeguards than those just wanting it just because it's easy or customary. I have a client that must collect and stor…
10y ago·view thread
comment
My parents always used a kettle on the stove to heat the water to make ice tea. Bring it to a boil and then pour into a pitcher with two big tea bags. Sometimes as a kid I would do that using the micr…
10y ago·view thread
comment
Yes, my router does have this. Which we use to have a simpler wifi password just to give to guests. It can only access the Internet and nothing on the LAN.
10y ago·view thread
comment
For my home, I fully believe that if things continue this way, I will need to have three networks at home. The household network and wifi for my wife and our family to use, the work network (hardwired…
10y ago·view thread
comment
My wife and I received an electric kettle as a wedding gift and it's pretty amazing how fast it brings water to a boil. But, she may end up taking it to her office at work as she has no stove the…
10y ago·view thread
comment
The amount in the bank account is very, very different than the budget. A startup should not be tracking its money on such a simple basis. Without categories (or envelopes) the amount of cash is prett…
10y ago·view thread
comment
I used AIM big time on my T-Mobile sidekick. It's something Danger did very well.
10y ago·view thread
comment
Looking at the demo without running it yet, that looks amazing. It reminds me a lot of the QBasic game Outer Space Wars that I wrote when I was 14, having taught myself QBasic from reading a book chec…
10y ago·view thread
comment
I believe the term is "malum in se" vs "malum prohbitium". Some crimes, especially murder are so wrong and universally so that it is a worse crime than one that is just wrong becau…
10y ago·view thread
comment
A programmable dimmer, such as one of the Casetas from Lutron, would work. Set the brigtnesses to a time to increase over a period of several minutes starting at your designed time.
10y ago·view thread