692 reputation
318
bio website johngraybosch.com
location
age
visits member for 2 years, 1 month
seen Jul 15 at 18:33

I'm an Application Developer in Long Island, NY.


May
6
revised Does prompting for security questions on new computers add any security on banking websites?
added 513 characters in body
May
6
comment Does prompting for security questions on new computers add any security on banking websites?
Would a PIN that you enter with the mouse via an onscreen keypad be a better solution?
May
6
comment Does prompting for security questions on new computers add any security on banking websites?
Actually after having thought about it, if the hacker has physical access to the computer you're logging in from, it's all over. He could key log the security questions. Or, he could grab the cookie that's used to mark the computer as "trusted." Are there any measures you could take that would help the user at all really, in this scenario? It doesn't look good...
May
6
comment Does prompting for security questions on new computers add any security on banking websites?
Seems like a diluted version of two factor authentication...
May
6
asked Does prompting for security questions on new computers add any security on banking websites?
May
6
comment VCS to manipulate returned trees to prevent leaks?
Ahh, I see you're asking a hypothetical question about what the big boys do. I agree with @Adnan about the NDA. Nobody wants to lose their house in a lawsuit ;)
May
6
answered Securing a network attached storage on the internet
May
6
comment Safe to connect to external drive?
If you're very concerned, you could boot to a Live CD and copy the files that way.
May
6
comment VCS to manipulate returned trees to prevent leaks?
Are you trying to prevent your developers from leaking your code to the outside world? That's a trust issue... If you can't trust them with your code, why are they in your network?
May
6
comment How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
Thanks, Xander. The linked question with the LSO piece helped to clarify things.
May
6
accepted How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
May
6
comment How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
I've clear my cookies and it doesn't re-prompt me. Cookies was my first thought too, but that rules it out.
May
6
asked How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
May
2
accepted US Department of Labor Watering Hole Attack
May
2
comment US Department of Labor Watering Hole Attack
So it appears that from a web developer's point of view, the lesson from this article is guard against XSS vulnerabilities. I'm surprised you can execute arbitrary code from JS though...
May
2
comment US Department of Labor Watering Hole Attack
@Xander thanks.
May
2
comment US Department of Labor Watering Hole Attack
"use a more modern browser" it affects all unpatched versions of IE technet.microsoft.com/en-us/security/bulletin/ms13-021
May
2
comment Is the execution time for bcrypt independent of the length of the input string?
Ok, I just took a guess. This guy actually knew the answer. I deleted my answer because it was incorrect.
May
2
asked US Department of Labor Watering Hole Attack
Apr
30
awarded  Popular Question