2014
- How did I get involved in PKI?
In the mid 90s I was a security consultant, I principally worked on authentication systems (Smart cards, One Time Passwords, Kerberos, PKI, etc.).
- The first web-server and the meaning of the SSL lock
The first web-server was developed by CERN in 1990 -- that is twenty-four years ago!
- What are some upsides of googles’s SHA1 deprecation plan?
NOTE: Google has since adopted a more gradual plan for migration which will addresses the potential false sense of urgency the prior plan represented. Personally I think the new plan is a good one. The upsides in this…
- Why might you have a certificate with a SHA1 based signature in its chain that is valid beyond 2016/1/1?
NOTE: Google has updated the plan they will be using to deprecate SHA1 based certificates. The content in this post is still mostly accurate but for dates please see the thread. Personally I think the new plan is a good…
- What will Chrome’s SHA1 early warning look like?
NOTE: Google has since revised its plan to enable a more gradual migration to SHA256, this post is no longer accurate.
- Smart cards, PC/SC and Chrome
Smart cards have been around since 1974 and as a technology while they have expanded their capabilities they still work in very much the same way they did back then.
- Smart cards, PIV, Bitcoin and secp256k1
I am thrilled to see Multi-sig (P2SH) getting adopted across Bitcoin industry it has the potential to significantly reduce the risks involve with storing Bitcoin online. With that said it is still dependent on software…
- Verifying a Bitcoin Wallet Address Tutorial
A few months ago I did a brief post on how to verify a Bitcoin wallet address as a follow-up to this post here is a presentation on how to do both approaches using CoinBase.
- Two Factor Authentication with BitGo and Coinbase
Online wallets such as BitGo and Coinbase make Bitcoin much more approachable. That said neither seem to prioritize enabling two-factor authentication. This is surely an artifact of them trying to minimize account setup…
- Cupid and Understanding Your Exposure
In a past life I was responsible for a number of Windows Enterprise Networking technologies including the EAP implementation and was a contributor to EAP-TLS.
- Bitcoin adoption in payments
If you talk to someone about using Bitcoin as a payment technology your surely going to hear about how governments are classifying it as an asset and not a currency and what the corresponding tax implications are.
- Bitcoin and the credit card ecosystem
We use our credit cards every day yet most of us don’t really understand what happens when we swipe a credit card at a merchant. Did you know there are no less than six different players (above and beyond the consumer…
- Proving assets under management is important but it is not an audit
Recently Bitstamp did a public display of assets under management and while I think its important they and others (like Kraken and the Vault of Satoshi) do this it does not an audit make.
- Liquidity risk and management in Bitcoin
This of course begs the question how liquid do you need to be? Surely the answer is at least partially tied to the volatility of the asset in question and what your individual exposure to the potential loss might be.
- SWIFT, CHIPS, ACH, Fedwire and Bitcoin…
Bank transfers, especially international bank transfers, can be incredibly complicated with many players both directly and indirectly involved.
- Beyond Builders, Defenders, and Breakers
There are lots of different types of Security Practitioners out there. At a high level they can all be thought of as Builders, Defenders or Breakers.
- Attacker Mind Map for Bitcoin
When thinking about how to protect something its useful to think about who you are protecting from. This normally starts with brainstorming categories of attackers along with their capabilities and motivations. From…
- A Bitcoin Risks Mind Map
This morning I spent some time putting down some the risks relating to Bitcoin that I considered before I made the switch to focusing my efforts on this space.Mind Maps are a great way to collect your thinking and XMind…
- Hardware Based Key Management and Bitcoin
Hardware based key management solutions like Smart Cards and Hardware Security Modules provide a lot of value. Probably the most important being that the keys are moved out-of-process into a totally separate computer.…
- If you don’t hold it, you don’t own it
If you know anyone who invests in precious metals you have probably heard the phrase “if you don’t hold it, you don’t own it”.
- Effectiveness of security controls in physical security
Lately I have been giving some thought to effectiveness of security controls in relationship to physical security.
- PiperWallet First Impressions
So I just got my PiperWallet. For those of you not yet familiar with it the PiperWallet is an open-source hardware bitcoin wallet based Electrum running on a RaspberryPi paired with a built in thermal printer in what…
- Verifying a Bitcoin Wallet Address
Before sending someone a large sum of money on the internet via a irreversible transaction you better make sure you are sending the funds to the right address.
- Certificate Path Building in PKIjs
Now that its possible to decode and verify the signature on X.509 certificates within the browser the natural question to ask is what can I do with that?
- MUST STAPLE and PKI.js
The other day I did a post on how to create a self-signed certificate using PKI.js in that sample we included a Basic Constraints extension but we could have also just as easily defined a custom or new certificate…
- Generating signed messages using CMS and PKI.js
One of the most common signature formats on the web is known as CMS SignedData, this is the signature format used in PDF files, CAdES, S/MIME and several other digital signature solutions.
- Frankencerts, new extensions and PKI.js
One of the things that we wanted you to be able to use the PKI.js libraries for is the X.509 Certificates, including those with new extensions (like testing for OCSP MUST Staple or for testing other certificate…
- Potential projects for PKI.JS
This is a list of potential projects that would benefit from PKI.js, can you think of any others that would be interesting?
- WebCrypto and PKI
Like it or not here it comes -- within the next few months WebCrypto will be supported in various degrees across all mainstream browsers. There are plenty of posts out there talking about the security concerns of…
- The bias of experience and ignorance of youth
It was really security (well pirate and BBS’s and IRC channels) that first got me seriously into computers. It was a place where I was surrounded with brilliant people and super interesting problems to explore. It did…
- Bitcoin Paper Wallets and Digital Backups
The folks working on Armory have done a wonderful job thinking about many of the risks associated with Bitcoin and Paper Wallets. The have even gone as far to consider the risks of a compromised printer with a feature…
- Keeping long-term passwords secured
We all know that passwords should be changed regularly to reduce the value to an attacker and that they should be stored in ways that they can not be easily compromised which is why generally people are encouraged not to…
- Protecting Bitcoin keys with hardware
One of the most important things you can do to keep your Bitcoin keys safe is to get them off of your general-purpose computer and onto a single use device that is designed to perform cryptography or Bitcoin operations.
- Keeping an eye on your Bitcoin keys
In the government, banking and certificate authority worlds important keys are generated and used within specialized cryptographic devices called Hardware Security Modules (HSMs) or their less powerful cousins smart…
- Insurance and Bitcoin
There are lots of ways we risk loosing our money one of the biggest is when the institutions we trust to keep those funds safe fail to do so.