938 reputation
421
bio website serverfault.com
location Manchester, NH
age 39
visits member for 1 years, 9 months
seen 7 hours ago

Moderator at Server Fault.

Contract system administrator since time out of mind. I can also read your code!

Do you miss seeing users' accept rates? Try my Accept Rate user script for Chrome!

If your DevOps is all Dev and no Ops, and you need help, contact me.


Apr
14
comment Advantages of one time pad
Back in World War II, the Soviets accidentally duplicated a large quantity of key material for one time pads, making it pretty easy for US and British intelligence to break these messages.
Mar
4
comment Is storing plaintext passwords for email accounts any less bad?
Related from Server Fault: What would you do if you realized your email hosting provider could see your passwords?
Feb
20
awarded  Quorum
Feb
1
revised Best practices for Tor use, in light of released NSA slides
Moving hidden services very often may not be well advised
Jan
25
comment Bank cards - chips vs mag stripe security
Smartcards also come with a liability shift, i.e. much of the liability for fraudulent purchases shifts from the bank to the consumer. It will be much more difficult for defrauded customers to recover lost money if it was stolen because their smartcard, or some part of the payment system, was compromised by a third party.
Jan
15
comment Help investigating potential website attack (URL rewriting and ROT-13 obfuscation)
@GrandAvenueSoftware Absolutely you should contact the other ISP. Skip the email and pick up the phone.
Jan
15
comment Can hackers detect my operating system?
I assume you are getting rid of XP soon, as well.
Jan
12
awarded  Announcer
Jan
11
awarded  Good Answer
Jan
10
answered Credit card information being sent over HTTP?
Jan
8
answered Kerberos authentication over the public internet
Jan
8
comment Kerberos authentication over the public internet
MIT Kerberos 1.11 now contains work so that clients do not have to sync their system clocks with that of the KDC. A time offset is discovered during preauth and stored along with the local credentials. This is now available in Fedora 19+ and RHEL 7.
Jan
6
comment How can I ensure that an android app was installed on a physical device and not an emulator?
stackoverflow.com/q/16213326/1068283
Jan
3
comment Separating Apache and MySQL over Tor for security, performance, and reliability
This is not the way to structure a hidden service. I've written about this previously here.
Dec
31
comment Identify users accessing hidden link in a website
It's trivial to copy a legitimate User-Agent string and program a bot to use it. If these links really were hidden, you can be reasonably sure that they aren't human visitors.
Dec
26
revised Is Teredo in my router a back door?
Fixed formatting and grammar
Dec
26
suggested suggested edit on Is Teredo in my router a back door?
Dec
26
comment How should we announce vulnerabilities in our application?
Related: How do I respond to a published security vulnerability in my application?
Dec
23
answered Is PPTP VPN ever secure? Under DD-WRT?
Dec
19
comment How can someone go off-web, and anonymise themselves after a life online?
This is hard. You could write a book about it. In fact, several have been written... Though, to be clear, what do you mean by "off-web"? If you stop using the Internet and your cell phone entirely, then there's not much data left.