Reputation
3,873
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
12 37 88
Impact
~383k people reached

2d
comment To what extent does formatting a disk (securely) remove its data?
What if the quick-format option is not checked?
Apr
13
comment What are the technical implmentation differences between signature based scanning and heuristic based scanning?
@M'vy I'm curious about both but if I had to pick I'd go with network traffic.
Apr
12
comment Why don't terminal IDs prevent unauthorized entery?
Thanks. So what exactly is the definition of control? Is it short for "security control" en.wikipedia.org/wiki/Security_controls ?
Apr
10
comment Is it more secure to delete emails from the server once a client has downloaded them?
Why the downvotes?
Apr
9
comment Is it more secure to delete emails from the server once a client has downloaded them?
Alright, but an attacker (or court) can still gain access to your personal machine...so is the argument really that valid from a user's security perspective? I guess in a sense that's just one less attack surface...but even as you mentioned the email on the server has to reside there for sometime and gets decrypted before passed to the network stack.
Apr
9
comment Is it more secure to delete emails from the server once a client has downloaded them?
@BrentKirkpatrick did you have time to look into it? I did some reading and it appears I'm right that POP3 deletes the messages from the server after a single client downloads them.
Apr
9
comment ProtonMail security concerns
Out of curiosity is there a way to prevent against "what would actually happen"? I used to work at a place where security (theater) was a high priority and we always had to keep our desk locked. At times this seemed silly to me, because I kept the key in my personal backpack which was right beside the desk. I considered hiding it better, but if someone's going to snoop through my personal backpack they probably wouldn't hesitate to search elsewhere.
Apr
9
comment Is it more secure to delete emails from the server once a client has downloaded them?
I know both IMAP and POP can support encryption, but what I meant is their argument valid if the email is stored encrypted on their server? This is relevant because if their server is compromised the attacker won't be able to read your email (also if a court orders a raid on the hard drives, even if they get them I don't think they can force the company to decrypt).
Apr
9
comment Is it more secure to delete emails from the server once a client has downloaded them?
@BrentKirkpatrick that's not my understanding
Apr
3
comment Is it bad if session key is passed in plain text in URL?
@RápliAndrás I heard that doesn't always work due to proxies and shared IP addresses and dynamic IP addresses.
Mar
30
comment Is there any way a website can show it hasn't been “hijacked” by the authorities?
@schroeder I'm not sure if I should delete this question because it's closed or leave it here because it received 4 upvotes?
Mar
10
comment Can't get into Damn Vulnerable Web App with Hydra even though correct password is supplied
Thanks I'll look into it.
Mar
10
comment Can't get into Damn Vulnerable Web App with Hydra even though correct password is supplied
@ it couldn't resolve dvwa and instead of "Username and/or password inccorrect" the failure message is "Login failed" and other than those 2 things your command is the same as the original
Feb
18
comment difference between need to know, least privilege and confidential
Is it that "least privilege" can apply to many things such as processes, users, use of assets but "need to know" is "least privilege" applied to data? Do I understand that correctly?
Feb
17
comment What is collusion and how does seperation of duties prevent it, or fail to prevent it?
Thanks, does collusion require at least one perpetrator to be employed by the business that's being robbed? For example would two thiefs be committing collusion if one lifts the other in through a window?
Jan
27
comment What person should I write a penetration test report as?
I think it's really depends on the company. I remember when I was at school I was taught to use the passive voice for reports, then one day I took a class where I lost marks for using it and was told to use the active voice.
Jan
27
comment Why didn't OSes securely delete files right from the beginning? And why do they still not do this?
@nocomprende it's actually another problem with the question being asked, it speaks as if all OSs are the same, which they are not. Windows is one of the most bloated OSs.
Jan
26
comment Why would a website want to know what operating system you are using?
@Purefan well ya, that's what I mean a legitimate use.
Jan
26
comment Why would a website want to know what operating system you are using?
@HamZa could you explain what you are thinking?
Jan
25
comment Confusing definitions of “parasitic virus” and “worm”
Are you saying something needs to exploit a vulnerability to be considered a virus?