Author Archives: Michael Altfield

References for [password length] > [complexity] (Academic Papers, Government Guidelines, Standards Publications) [closed]

Posted on by

I’m looking for a set of documents from reputable sources that explicitly state that password (passphrase) length is exponentially more important than password complexity.
Consider the following password policies:
[a] Passwords must contai… Continue reading References for [password length] > [complexity] (Academic Papers, Government Guidelines, Standards Publications) [closed]→

What are equivalent Asian organization of NIST, especially in the Security Computer Division? [closed]

Posted on by

What are some Asian-equivalent organizations comparable to USA’s NIST?
I want to check the best practices and guidelines on computer security. Does anyone know if there are similar organizations in Asian countries that publish recommendati… Continue reading What are equivalent Asian organization of NIST, especially in the Security Computer Division? [closed]→

Webserver DDOS protection without giving away private keys (https, tls, ssl)

Posted on by

What are the possible ways to protect an organization’s web servers from a DDoS attack without giving away your web server’s https private keys?
Many of the common solutions for DDoS protection of a web server (eg CloudFlare) require you t… Continue reading Webserver DDOS protection without giving away private keys (https, tls, ssl)→

Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Posted on by

Does the snapd package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
I know that software downloaded with apt-get packages must be cryptographically verified beca… Continue reading Does snapd enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)→

Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)

Posted on by

Does the built-in apt package manager in Debian-based systems require successful cryptographic authentication and integrity validation for all packages?
My understanding was that software downloaded with apt-get packages would be cryptogra… Continue reading Does apt-get enforce cryptographic authentication and integrity validation by default for all packages? (debian, ubuntu)→

Best Practices Guides for Enterprise PKI Setup (root CA generation, storage, backup)

Posted on by

What are the best guides available for how to create and maintain an enterprise X.509 PKI setup for an organization?
I’m looking for some guide that comprehensively covers how to setup and manage a CA hierarchy. It should cover:

Abstract … Continue reading Best Practices Guides for Enterprise PKI Setup (root CA generation, storage, backup)→

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Posted on by

Does the npm package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with steps ask… Continue reading Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?→

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Posted on by

Does the yarn package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with steps as… Continue reading Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?→

How to pin public root key when downloading an image with docker pull (Docker Content Trust)?

Posted on by

How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn’t have a valid signature using the private key corresponding to (or subordinate to) the public key that I provide?
I just discovered th… Continue reading How to pin public root key when downloading an image with docker pull (Docker Content Trust)?→