I'd like to implement some kind of simple (yet as strong as possible) encryption for my client-server application network traffic. Data to be encrypted can be both textual, and binary.
Now I'm thinking about using just a trivial XOR encryption, but with following features:
Key will be random (...
We've just implemented a proxy that decrypts all SSL traffic in order to classify and scan it. Naturally a lot of our users feel concerned. We're a small company (100 users) owned by a big company (5000 users). What we hear internally is that "other companies doesn't do this". I think that this i...
How I set up @djangoproject + @angularjs + @ProtractorTest + @docker + @circleci + @AWSOpsWorks https://github.com/onetouchapps/django-angular-docker-circleci-opsworks
seriously, I know our industry is screwed up in so many ways they had to invent a new number for it, but how does nobody notice how bad javascript sucks?
nevermind who had the brilliant idea to build these big stacks on a sucky basis like javascript - who was the bigger idiot that heard that idea and responded with "HELL YEAH!" ??
sure, that part is nothing new. The part that really appalls me though, is that legitimate programmers - and programmer organizations - are actually on board with it.
is it just a question of "if you can't kill em, might as well join them and make money off them" ?
no I understand what you're saying. But its still a load of crock, because every PROPER development framework has wizards / samples / components / whatever that let you do the same thing, better, in a fraction of the time.
Tax bodies like tax to be complicated, that way if you make a mistake they can charge you for it, and if they make a mistake they just claim more money from you
@RoryAlsop yeah accountants are very good for that kind of thing, the paperwork I can handle ok, knowing what to do to avoid HMRC issues I would have no idea
@RoryAlsop well the tax mans definitely isn't to the point that once when me and the missus tried to do it without an accountant, we spent days trying to work something out, got it wrong still and got fined by the revenue!
heh someone just flagged an exclamation of "Java is the best language there is"
@AviD I don't think I'd call it that, simply because his construction is a block cipher. It's lousy encryption for sure, but I don't see a lot of similarities with a OTP.
@AviD It's not just about trusting employees though is it? It's also about when a trojan takes advantage of a browser 0-day, or when somebody falls for a particularly good phish, ensuring that you notice when someone or something malicious is trying to exfiltrate sensitive data. Trusting your employees doesn't mean that you don't verify the data entering and leaving your network.
@AviD I feel like a lot is missing. The education of not creating your own crypto should be mentioned. And securing the session keys is an important detail he fails to present.
as such, I will leave my answer standing, such as it is, since it is referring (or trying to refer) to OTP, or rather a broken OTP, which is what my answer answers.
The Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution.
The Vigenère (French pronunciation: [viʒnɛːʁ]) cipher has been reinvented many times. The method was originally described by Giovan Battista Bellaso in his 1553 book La cifra del. Sig. Giovan Battista Bellaso; however, the scheme was later misattributed to Blaise de Vigenère in the 19th century, and is now widely known as the "Vigenère cipher".
Though the cipher is easy to understand and implement, for...
I'm trying to build a cybersecurity ontology graph, starting not from scratch would be helpful. Anyone have the knowledge of an existing open cyber security ontology (taxonomy), it would be very helpful.
@AviD In my experience, when people are attempting to refer to, or create a pseudo-OTP, they don't invent goofy block ciphers...They invent goofy keystream generators.
@AviD seems to me that Iserni and @Xander are pretty much spot on there, but I like your "rubber-hose cryptanalysis" :) You might also wanna cross-reference IP's of OP's "TX_" and your commenter's "thexacre" accounts ... their handles seem suspiciously similar
@TildalWave I dont think they're wrong, but I still think the OP's intent is an OTP, even though he doesnt know it. And he is going about it the wrong way.
@Simon "ring his doorbell"? Why would they have it locked? Open the door by any means necessary and use their bathroom. If you can't open the door, just do your business on their door.
@Simon So seriously though...Do they have to remediate it? Typically it's fine if it's left alone. It's only when you want to remodel that you have to deal with it, unless it's actively disintegrating.