Patrick on Security https://patrickmn.com/feeds/security.xml Patrick Mylund Nielsen contact@patrickmn.com 2017-04-08T01:28:00Z Quorum and Constellation https://patrickmn.com/security/quorum-and-constellation/index.html 2017-04-08T01:28:00Z 2017-04-08T01:28:00Z Two blockchain-related projects I've been working on for the past year: Quorum, Ethereum with privacy, and Constellation, an MTA+PGP+Keyserver combo using djb crypto. On Cryptographic Backdoors https://patrickmn.com/security/on-secure-golden-keys/index.html 2015-03-04T00:00:00Z 2015-03-04T00:00:00Z Why cryptographic backdoors, or 'secure golden keys', are a bad and unnecessary idea, even for law enforcement. Problems with Cyber-Attack Attribution https://patrickmn.com/security/problems-with-cyber-attack-attribution/index.html 2015-01-01T00:00:00Z 2015-01-01T00:00:00Z These days, we're quick to point our finger at the most likely culprit of a cyber-attack, but attribution is very difficult, and we must tread carefully. Beware of "Read-Only Bank Access" https://patrickmn.com/security/beware-read-only-bank-access/index.html 2014-09-17T00:00:00Z 2014-09-17T00:00:00Z Many services encourage you to connect your online banking accounts in a "secure and read-only manner," but these assurances are deceptive. Gambling with Secrets: an Introduction to Cryptography https://patrickmn.com/security/gambling-with-secrets/index.html 2012-09-13T00:00:00Z 2012-09-13T00:00:00Z A very approachable miniseries on the history of cryptography, random number generation, key exchange, asymmetric encryption, cryptanalysis and why the Allied Forces broke the Nazis' Enigma machine. The Secure Remote Password Protocol Isn't Bad https://patrickmn.com/security/secure-remote-password-isnt-bad/index.html 2012-08-14T00:00:00Z 2012-08-14T00:00:00Z Blizzard Entertainment has been receiving a lot of flak recently for using the Secure Remote Password protocol. That's wrong. Implementing Two-Factor Authentication Is Easier Than It Seems https://patrickmn.com/security/you-can-be-a-twofactor-hero/index.html 2012-08-07T00:00:00Z 2012-08-07T00:00:00Z Perhaps the most effective complement to passwords is two-factor authentication, and it's surprisingly easy to use and implement. Here's an example. The History of Password Security https://patrickmn.com/security/the-history-of-password-security/index.html 2012-06-07T00:00:00Z 2012-06-07T00:00:00Z A summary of how password authentication and security functions have evolved since the 1970s, and an interesting look at concepts like salting which were used way before you'd probably expect. Storing Passwords Securely https://patrickmn.com/security/storing-passwords-securely/index.html 2012-06-06T00:00:00Z 2012-06-06T00:00:00Z Why "SHA 256-bits enterprise-grade password encryption" is only slightly better than storing passwords in plain text, and better ways to do it. What's Old Is New Again https://patrickmn.com/security/whats-old-is-new-again/index.html 2012-04-19T00:00:00Z 2012-04-19T00:00:00Z A new security vulnerability in OpenSSL turns out to have been included in a book about finding security vulnerabilities, 6 years ago!