Reputation
3,638
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
12 34 85
Impact
~345k people reached

Jan
27
comment What person should I write a penetration test report as?
I think it's really depends on the company. I remember when I was at school I was taught to use the passive voice for reports, then one day I took a class where I lost marks for using it and was told to use the active voice.
Jan
27
comment Why didn't OSes securely delete files right from the beginning? And why do they still not do this?
@nocomprende it's actually another problem with the question being asked, it speaks as if all OSs are the same, which they are not. Windows is one of the most bloated OSs.
Jan
26
comment Why would a website want to know what operating system you are using?
@Purefan well ya, that's what I mean a legitimate use.
Jan
26
comment Why would a website want to know what operating system you are using?
@HamZa could you explain what you are thinking?
Jan
25
comment Confusing definitions of “parasitic virus” and “worm”
Are you saying something needs to exploit a vulnerability to be considered a virus?
Jan
12
comment Why would security cover things like natural disasters?
@gnasher729 you misunderstood: I said an employer is less likely to higher a security consultant rather than some sort of sort of construction worker for things like the roof or fire proofing.
Jan
11
comment Why would security cover things like natural disasters?
@Burgi that's what I thought but when I said that in class everyone laughed and said it's for pedestrian safety.
Jan
11
comment Why would security cover things like natural disasters?
@Josef wouldn't that require a background in carpentry or structural engineering, and be best left to those types of professionals? Plus feel free to stop using exclamation marks and bold letters.
Jan
11
comment Why would security cover things like natural disasters?
I guess my point is, in a practical scenario, which would a company more likely do: make sure they have a good quality roof, or pay for water proof computers? With the security perspective we seem to be talking about the latter, which isn't cost effective.
Jan
11
comment Why would security cover things like natural disasters?
So anything that would hamper availability is a security problem? Somethings seem to be more a usability issue, like if the user does not know how to turn on the computer or insert the media.
Jan
11
comment Why would security cover things like natural disasters?
@Josef 1) I wouldn't call it blame I'd call it reasonable 2) It wasn't a security measure in the first place to have a non-leaking roof so it wouldn't be the security analyst's fault 3) in that sense what wouldn't be security?
Jan
10
comment Why would security cover things like natural disasters?
Isn't that an overly pedantic view of availability? If there's someone using a computer that you need to be on, you wouldn't say that's a security problem.
Dec
15
comment What is a YubiKey and how does it work?
Ya but you don't necessarily know a file is a keyfile on a USB stick or what password/username it goes with. Could you elaborate on this attack vector about how USB sticks are easy to read so that would compromise the key file?
Dec
14
comment What are attackers trying to achieve when doing attacks on local programs such as buffer overflows?
But isn't a user already doing code execution by running the program? So what's the gain?
Dec
13
comment Encrypting files on Google Drive
7-zip portable isn't available for OS X
Dec
13
comment Could somebody explain how DNS poisoning might occur in this scenario?
How do we know what the IP address should be spoofed to - how do we know the IP address of the higher up DNS server the first one queries when it doesn't have the entry?
Dec
13
comment Why is a DNS Amplification attack considered a DDoS attack?
From this question it sounds as if a single "misconfigured" DNS resolver would be enough to attack someone security.stackexchange.com/questions/93820/… ...so is DNS amplification attack always a DDoS attack?
Dec
13
comment Must an attacker using a Smurf attack be on the same network as the victim?
Ok so I have trouble understanding the way you wrote it but I think I know what's going on. Is it before 1999 the standard was for routers to allow incoming broadcast requests from the internet, but after 1999 the standard was for this feature to be disabled by default?
Dec
13
comment Security evaluation terminology
So is this all done before a product is implemented e.g. before programming begins?
Dec
13
comment What is a YubiKey and how does it work?
How is this better than a USB key with a keyfile? If a Yubikey gets stolen, then the attacker can still use it.