Posted by jpluimers on 2017/01/18
How good is this?
Access Secret Server using Web Services: mobile apps, third party applications, and scripts (with the proper authentication).
Source: API Web Services, integration with third party applications, Secret Server | Thycotic
I bumped into this after searching for winauthwebservices/sswinauthwebservice.asmx
https://www.reddit.com/r/sysadmin/comments/2o1gvd/thycotics_secret_server_is_on_sale_again/
http://thycotic.com/products/secret-server/compare-installed-editions/
–jeroen
Posted in Development, Hashing, Security, Software Development | Leave a Comment »
Posted by jpluimers on 2016/10/28
I’m really glad that more and more suppliers are providing sha hashes for their downloads.
It allows you to verify an already downloaded binary is in fact
For instance, Cisco does this with their Jabber Messaging software. That way I could verify the (when I wrote this) most recent versions were indeed the ones I already had by just clicking on the filename (no need to click on the Download button).
–jeroen
Posted in Hashing, Power User, Security | Leave a Comment »
Posted by jpluimers on 2016/10/24
This Plain Text Offenders site lists email screenshots of organisations sending back plain-text passwords they kept on file (According to Robert Love, Idera/Embarcadero should be on the list as well).
It is one of the most horrible things that can be done for a password.
Business and IT do many horrible things, so I really hope someone will start a similar site about SSL Labs F-rated domains. The ones that are so broken that they degraded their https to virtually plain-text http quality.
In the past, a notorious example of this was Embarcadero, who in the past managed to get F-rating or had wrong configurations on the below domains, therefore preventing me from logging in and getting new products from them (which is far worse than them not cleaning up their bug database):
Posted in Delphi, Development, Hashing, https, OpenSSL, Power User, Public Key Cryptography, QC, Security, Signing, Software Development | 3 Comments »
Posted by jpluimers on 2016/08/08
It works (but is sloooooow)
Source: BashonWindows (Ubuntu from Win10) not finding openssl · Issue #337 · drwetter/testssl.sh
Posted in Encryption, Hashing, https, OpenSSL, Power User, Security, testssl.sh | Leave a Comment »
Posted by jpluimers on 2016/07/20
Great explanation of Diffie-Hellman Key Exchange – YouTube.
It is based on mixing colors and some colors of the mix being private.
Brilliant!
–jeroen
https://www.youtube.com/watch?v=YEBfamv-_do
Posted in Algorithms, Development, Encryption, Hashing, https, OpenSSL, Power User, Public Key Cryptography, Security, Software Development | Leave a Comment »
Posted by jpluimers on 2016/07/11
Still relevant after a few years: DEFCON 17: More Tricks For Defeating SSL – YouTube.
I landed there after trying to find out how to verify the Internic root server file is actually pubished by Internic via authentication – Ways to sign gpg public key so it is trusted? – Information Security Stack Exchange.
I remember reading his “if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom” post (Moxie Marlinspike >> Blog >> The Cryptographic Doom Principle), but never noticed his videos.
It is still relevant as there are lots of implementations still vulnerable to these kinds of attacks.
Many more of his blog entries are interesting as well:
Posted in Encryption, Hashing, https, OpenSSL, PKI, Power User, Public Key Cryptography, Security, Signing | Leave a Comment »
Posted by jpluimers on 2016/06/10
For my own reference:
Always get at least two keys, configure them, and use only one. Store the rest in a safe place for when the first dies.
Get the NEO (if you need NFC) or NEO-n (if you don’t need NFC but love small form-factor).
–jeroen
(Image courtesy of Yubico)
Posted in Encryption, Hashing, Power User, Security, U2F FIDO Security Keys | Leave a Comment »
Posted by jpluimers on 2015/11/27
It feels like yesterday, but haxpo2015ams was already six months ago!
Session materials index:
–jeroen
Posted in *nix, *nix-tools, Encryption, Hashing, https, LifeHacker, OpenSSL, PKI, Power User, Public Key Cryptography, Security, Signing | Leave a Comment »
Posted by jpluimers on 2015/11/11
Interesting: Hash Toolkit – Reverse MD5 / SHA1 Hashes
They generate and allow you to generate various hashes, and store both the hash and original so you can reverse it.
Not meant for production data, but an approach for verifying if you do hashing correctly.
–jeroen
via: Hash Toolkit – Reverse MD5 / SHA1 Hashes.
Posted in Development, Hashing, md5, Power User, Security, Software Development | Leave a Comment »
Posted by jpluimers on 2015/11/05
Interesting: Life in a post-database world: using crypto to avoid DB writes.
For some security related operations, you only need smart use of HMAC, and no temporary database entries.
Thanks for the Jan Wildeboer referral to this.
–jeroen
Posted in Development, Hashing, Power User, Security, Software Development | Leave a Comment »
![[ICO]](https://wiert.me/wp-content/uploads/2015/10/blank.gif)
![[PARENTDIR]](https://wiert.me/wp-content/uploads/2015/10/back.gif)
![[ ]](https://wiert.me/wp-content/uploads/2015/10/layout.gif)