2,449 reputation
319
bio website
location
age
visits member for 2 years, 6 months
seen Nov 26 at 9:33

Dec
1
awarded  Nice Answer
Dec
1
awarded  Tumbleweed
Nov
24
revised Are paravirtualized drivers a security risk?
added 1721 characters in body
Nov
24
comment Would running VMs inside of VMs be a more secure way to study viruses, etc?
security.stackexchange.com/questions/73522/…
Nov
24
asked Are paravirtualized drivers a security risk?
Nov
24
comment Would running VMs inside of VMs be a more secure way to study viruses, etc?
@MichaelHampton I think the last part was my own idea and there is no other source. IMO, paravirtualized drivers are not subject to SELinux security controls because SELinux controls userspace processes, files, etc. I think paravirtualized drivers work by direct communication between guest kernel and hypervisor, which results in superior performance, but expose a part of hypervisor to the guest, that would otherwise be unreachable. I have no evidence for this, so I could be completely wrong.
Jul
10
revised Is “Why Should You Avoid AES In MySQL?” true?
added 213 characters in body
Jul
2
awarded  Yearling
Jun
25
comment Is it generally a bad idea to encrypt database fields?
@chiborg The only way I know that could be possible is through a "Dynamic evaluation vulnerability" (eval() function). If one can do that, they can also manipulate internal application state, give themselves admin privileges, etc. SoA + tight MAC protect against other attacks.
Apr
2
comment Securing Docker and LXC
How would a successfully exploited web application running as a Docker container escalate privileges using a kernel exploit if the container is restricted with SELinux? You'd need to write the file containing exploit code, make it executable, then execute it and hope it works. And even then, you're still limited by cgroups namepsaces, etc.
Apr
2
comment Securing Docker and LXC
root user that drops capabilities has less privileges than a "normal" root user.
Mar
20
comment Best approach for restricting remote ssh session
hosts.allow and hosts.deny (TCP wrappers) files were used before firewall usage became common and their usage is deprecated because not all daemons (servers) support them. It's recommended to use a firewall like "iptables". If you still want to use them, read the man page for them - "man hosts.deny".
Mar
20
answered Best approach for restricting remote ssh session
Mar
12
comment Isolate dual system
Try qubes-os.org/trac . It's designed exactly for what you need.
Mar
10
comment Storing passwords in reversible form - a genuine use-case
I'd never trust my bank authentication credentials to a 3rd party.
Mar
5
answered Debian missing security features?
Mar
5
comment Are there any secure ways to store the secret key used in a TOTP scheme?
Having access to the database service does not equal having full access to the underlying server. If you use a MAC like SELinux, you can severely restrict what an attacker can do with a compromised (database) service. You can prevent all file access outside of files needed for normal DB operation, you can prevent execution of all binaries, prevent all network (and local IPC) communication expect the one between the DB binary and some binary at a remote host (application).
Mar
3
reviewed Reject Why Do we Need CAPTCHA? In what case we should use it?
Mar
3
comment Are there any secure ways to store the secret key used in a TOTP scheme?
If you have a HSM, you store the symmetric key inside of it, same goes for software version (SSM) of it. Without HSM, you can store the key inside the application, like in a separate file, application config file, environment variable or fetch it from some other service using API at application startup. HSM will generate the key for you inside the device itself. In software, you can use openssl_* functions or read 32 bytes (256-bits) from /dev/urandom.
Mar
2
answered WEP > WPA? Why?