Trust Nothing if You Want Real Security

As I looked over the schedule for Check Point’s CPX 360 conference, one keynote session jumped out at me, not because of the topic but because of the name of the presenter: Freaky Clown, in all caps. “You’ll want to go to that one,” someone from Check… Continue reading Trust Nothing if You Want Real Security

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security?

In a “Policy as Code” system which relies on consumers of … Continue reading Does allowing a user to know their own authorized capabilities decrease security?

Explain HOW a Digital Signature is employed for providing a proof of the authenticity (not integrity!) Of a file?

Dr. asked the following question
Explain HOW a Digital Signature is employed for providing a proof of the authenticity (not integrity!) Of a file?
I do not know the exact answer

Continue reading Explain HOW a Digital Signature is employed for providing a proof of the authenticity (not integrity!) Of a file?

Is the common recommendation to obscure the existance of a username on login just security theater?

It is a common recommendation to return “Username or password is incorrect” instead of “Username does not exist” when the given username does not exist and “Password is incorrect” when username exists but password is wrong.

Continue reading Is the common recommendation to obscure the existance of a username on login just security theater?