Why You Should Encrypt ALL Personally Identifiable Information (PII)
Many critics have pointed out that Ashley Madison should have encrypted all personally identifiable information (PII). The database contained sensitive information that would cause harm to users if it...
View ArticleStoring X.509 Digital Certificates (And Other Messy Things)
We often need to store structured binary data in our database – images, pdf documents, etc., but also have a need to search by, or index on, attributes of that data. E.g., we might store the height and...
View ArticleAn Alternate Way To Get A Key: Key Servers
I’ve previously mentioned providing an encryption key via a JNDI value provided by an appserver, or better yet splitting the key between that JNDI value and a file outside of the webapp directory. A...
View ArticleAuto-encrypting Serializable Classes
A crazy idea came up during the post-mortem discussions in the Coursera security capstone project. Can a class encrypt itself during serialization? This is mostly an academic “what if” exercise. It is...
View ArticleLessons from BIBIFI
I haven’t posted in a while since I’ve been very busy. Coursera classes on computer security, cloud computing and geospatial technologies, corporate initiatives, even an Amazon Web Services...
View ArticleSigning Digital Certificates with OpenSSL Library
While working on the pgopenssltypes extension I realized that I haven’t discussed how to sign digital certificates using the OpenSSL library. (At least I don’t recall doing so – I might have discussed...
View ArticleAdding OpenSSL User-Defined Types to PostgreSQL
PostgreSQL supports user-defined types (UDT). These types can be used to provide type-safety on user-defined functions when we would otherwise be forced to use simple BLOB objects. This comes at a...
View ArticleDatabase Threat Models
I finally have a breather and can start working through my backlog of ideas. I start with some background that will make the motivation for subsequent posts clearer. What are the threat models for the...
View ArticleUsing rlimit (And Why You Should)
I’ve been going through some old notes and came across a reminder of setrlimit(2). This is a C system call that allows an application to specify resource limitations on a number of important...
View ArticleGetting A List of Available Cryptographic Algorithms
How do you learn what cryptographic algorithms are available to you? The Java spec names several required ciphers, digests, etc., but a provider often offers more than that. Fortunately this is easy to...
View ArticleCheck your REST parameters!
I was doing research related to my ongoing “project student” series and realized that I had made one of the most common – and most easily remedied – mistakes. I wasn’t using everything I know about the...
View ArticleClik here to view.
Fokirtor You Too
There’s a Linux backdoor in the wild. It isn’t widespread but it’s conceptually simple and copycats are a real possibility. Do not be complacent because you run Linux. See Fokirtor [Schneier on...
View ArticleWhat I’m Reading: November 2013
What I’m “reading,” November 2013: Coursera class: Principals of Reactive Programming (second course in Scala). I also need to finish Programming in Scala. Scala in Depth and Scala in Action will...
View ArticleCreating Vulnerability Assessment Artifacts Using Maven Assembly
This article will discuss using Maven Assembly to create artifacts that can be provided to third-party vulnerability assessment sites (e.g., Veracode) for review. Static Analysis for Bugs vs....
View ArticleCreating Password-Based Encryption Keys
This article discusses creating password-based encryption PBE keys. First a reminder of earlier points – as a rule you should, when practical, use the PBE key as a master key that is used solely to...
View ArticleDatabase Encryption Using JPA Listeners
I recently had to add database encryption to a few fields and discovered a lot of bad advice out there. Update I recently learned how to handle spring injection into JPA listeners. Details at...
View ArticleUsing Sequences as Encryption IVs
Anyone using low-level encryption libraries should know that you need both a SecretKey and a “random” IV. The easiest way to get a good IV is to use a SecureRandom instance to generate the necessary...
View ArticleMore on Password Encryption
I was recently reading Spring Security 3 and it made an interesting point about some LDAP servers. The servers never provide the (hashed) password. That raises the immediate question of how you can...
View ArticleNot Responsible For Broken Windshields
My wife says I get grouchy when I’m studying or doing security. I have no idea why…. Today’s beef is with the open-bed truck companies that have “not responsible for broken windshield” stickers on the...
View Article
![ONEW – KAKERA -Unmei no Piece- – EP [iTunes Plus M4A]](http://is1-ssl.mzstatic.com/image/thumb/Music221/v4/d0/fb/86/d0fb86a5-ba60-4bea-41fb-7f54c125f518/VEATP-45908.jpg/296x296bb.webp)
