Reputation
840
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 13
Impact
~28k people reached

  • 0 posts edited
  • 0 helpful flags
  • 60 votes cast
Aug
10
awarded  Popular Question
Jul
18
awarded  Good Answer
Jun
11
comment nmap says “variable 'keys' is not declared” when trying to run ssl-ccs-injection.nse
This worked for me as well. One thing to note, the example usage says nmap --script ssh2-enum-algos target, but I had to include service scanning to meet the dependencies for the check by adding -sV.
Jun
10
awarded  Yearling
May
5
comment What is the difference between SSL vs SSH? Which is more secure?
@jpillora I merely meant that I don't think the SSH transport layer protocol is what most people would mean given the phrasing of the question. However, given the answer that was accepted as correct, it must have been what OP was asking.
May
4
comment What is the difference between SSL vs SSH? Which is more secure?
+1 @jpillora while I agree it does make sense to compare the two, the term SSH is not typically used to refer to the subset of the SSH protocol that handles transport layer security that would be directly comparable to SSL/TLS. It is almost exclusively used in reference to the application layer protocol which differs from SSL/TLS in the manner described in this answer.
May
4
comment How valid is this statement “SSL sit between application layer and network layer”
TLS stands for Transport Layer Security. In the OSI model this layer is responsible for end-to-end connections and reliability and is between application and network layers.
Jan
21
comment Whats the difference between MAC vs hash
As you mentioned, a hash function can form the basis for a MAC. Block ciphers are the other building block of MACs and are called a CBC-MAC. The blocker cipher used in these functions can differ between implementations--DES, AES, etc.
Jan
6
comment Can Amazon's AWS Identity and Access Management (IAM) be used to manage server access?
A default SSH key doesn't necessarily violate PCI DSS as long as the key is assigned to a specific user and only that user has the corresponding private key.
Nov
13
answered PCI DSS - mask PAN and log individual access to PAN
Oct
25
comment Shared Database and PCI Compliance
Unfortunately, segmentation means isolation for PCI, i.e. no connectivity. Timee is right that the DB will be an issue. But since the shared DB is "in scope" but not "in the CDE" things that are connected to it are not brought into scope.
Oct
3
comment masking credit cards PAN with zeros
@Polynomial When an auditor does a scan of your systems and finds you're storing full card numbers, that will open up unnecessary discussions at the least. I think what Timee is trying to say is that if your masking function produces real card numbers, in a very small number of cases the input card equals the output card. That seems like a bad masking function at least and a non-compliant one at worst.
Sep
24
awarded  Autobiographer
Aug
1
comment Using a Public-Key-Encryption browser side to avoid PCI compliance
Up vote for Braintree!
Jun
24
comment Minimum requrements for storing last 4 digits of credit card number?
@AndreyBotalov, PCI only applies if you are the one doing the truncation, i.e. you receive full numbers and then discard a portion of them. PCI Applies if you store/process/transmit, so it is applicable because you are transmitting, not because you are storing the last 4. The last 4 is not cardholder data.
Jun
12
comment How to store credit card information for repeated transactions and still be PCI compliant?
The web server can absolutely be in scope, it is entirely dependent on the implementation. See the official guidance: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/…
Apr
14
awarded  Editor
Apr
14
revised Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
added 84 characters in body
Apr
14
comment Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable
Of the tools you listed, I would trust Qualys SSL Labs or the python PoC. Qualys because of their reputation and incentives and the python PoC because of its auditability.
Apr
14
answered Heartbleed: OpenSSL v 0.9.8o and OpenVPN v 2.1.3 Reporting Vulnerable