2,366 reputation
317
bio website
location
age
visits member for 2 years, 2 months
seen Aug 16 at 9:11

Jul
10
revised Is “Why Should You Avoid AES In MySQL?” true?
added 213 characters in body
Jul
2
awarded  Yearling
Jun
25
comment Is it generally a bad idea to encrypt database fields?
@chiborg The only way I know that could be possible is through a "Dynamic evaluation vulnerability" (eval() function). If one can do that, they can also manipulate internal application state, give themselves admin privileges, etc. SoA + tight MAC protect against other attacks.
Apr
2
comment Securing Docker and LXC
How would a successfully exploited web application running as a Docker container escalate privileges using a kernel exploit if the container is restricted with SELinux? You'd need to write the file containing exploit code, make it executable, then execute it and hope it works. And even then, you're still limited by cgroups namepsaces, etc.
Apr
2
comment Securing Docker and LXC
root user that drops capabilities has less privileges than a "normal" root user.
Mar
20
comment Best approach for restricting remote ssh session
hosts.allow and hosts.deny (TCP wrappers) files were used before firewall usage became common and their usage is deprecated because not all daemons (servers) support them. It's recommended to use a firewall like "iptables". If you still want to use them, read the man page for them - "man hosts.deny".
Mar
20
answered Best approach for restricting remote ssh session
Mar
12
comment Isolate dual system
Try qubes-os.org/trac . It's designed exactly for what you need.
Mar
10
comment Storing passwords in reversible form - a genuine use-case
I'd never trust my bank authentication credentials to a 3rd party.
Mar
5
answered Debian missing security features?
Mar
5
comment Are there any secure ways to store the secret key used in a TOTP scheme?
Having access to the database service does not equal having full access to the underlying server. If you use a MAC like SELinux, you can severely restrict what an attacker can do with a compromised (database) service. You can prevent all file access outside of files needed for normal DB operation, you can prevent execution of all binaries, prevent all network (and local IPC) communication expect the one between the DB binary and some binary at a remote host (application).
Mar
3
reviewed Reject suggested edit on Why Do we Need CAPTCHA? In what case we should use it?
Mar
3
comment Are there any secure ways to store the secret key used in a TOTP scheme?
If you have a HSM, you store the symmetric key inside of it, same goes for software version (SSM) of it. Without HSM, you can store the key inside the application, like in a separate file, application config file, environment variable or fetch it from some other service using API at application startup. HSM will generate the key for you inside the device itself. In software, you can use openssl_* functions or read 32 bytes (256-bits) from /dev/urandom.
Mar
2
answered WEP > WPA? Why?
Mar
1
answered Are there any secure ways to store the secret key used in a TOTP scheme?
Feb
28
comment MySQL AES Encryption - Is it good idea to store 3rd Party Auth Tokens using AES Encryption?
You cannot choose a different mode of operation, ECB is the only option.
Feb
23
answered Should you notify software vendors that their software has been cracked?
Feb
16
answered Is IP whitelist sufficient to protect a server?
Feb
16
comment Should IBAN and bank details be considered private data and encrypted?
There is an example of someone posting the bank details in EU and losing money because of it. news.bbc.co.uk/2/hi/7174760.stm
Feb
15
comment Why pull upgrade from production server rather pushing them from development server?
May I ask what book are you reading? I'd like to check it out.