288 reputation
19
bio website none
location Midwest
age 32
visits member for 1 year, 8 months
seen Apr 11 at 18:08

Just another sad, but unremarkable tale of a bright kid who squandered his potential and ruined his life by turning to a life of IT.

Since first embarking down this dark path, I've done a little bit of everything, from small businesses to large datacenters, Linux to Windows, networking and security, DBA roles and, in my darkest moments, even some light mainframe operations.

These days it's Microsft products paying the bills, for what difference it makes. Whether it's a multi-domain AD environment with tens of thousands of users, a small cluster of Linux webservers, or a tangled web of network cables, systems are all just complex tools to do complex jobs, perpetually in need of someone to make them perform better and ensure they're always available when someone needs them.

Since being a lawyer seemed to boring, being a doctor seemed to hard, and my idea of a good time usually involves using a powerful computer anyway, I really can't imagine doing anything else.


Apr
11
accepted How would you know a certificate/private key if you extracted it from RAM? Or would you?
Apr
11
asked How would you know a certificate/private key if you extracted it from RAM? Or would you?
Mar
28
comment How do big companies and wealthy people secure their information? And how can I secure mine?
And also, how do large corporations and VIP (billionaires, celebrities, heads of state) individuals secure their passwords? They... don't. Worked for a guy once, owned a decent sized company (and a bunch of smaller ones), with a personal worth of mid-nine figures, and his password for everything was bob. Three guesses what his first name was. Assuming that the rich and powerful actually do security right is a very dangerous assumption. Focus instead on how to do it right, and ignore the mind-numbingly foolish practices of the rich and famous.
Mar
28
answered can you update a one-time pad, over one-time pad encryption (compressed)?
Mar
12
comment Is it possible to boot an encrypted server remotely and securely?
No one mentioned out of band management. iLO, iDRAC, etc. Weird.
Feb
21
comment A service that claims beyond army level encryption
<shrug> Achieving "beyond [insert government agency] encryption" is pretty trivial. I use Truecrypt, and use a triple cascade of 256 bit ciphers to protect my data. To my knowledge, no government agency anywhere has an encryption standard that stringent, so anyone with access to a free encryption program can achieve "beyond [insert government agency] encryption" by clicking through a wizard. Doesn't actually mean that data's more secure than the army's, though. Just product marketing to make their service sound impressive and attract customers.
Feb
20
comment Ping Of Death reconstruction against a Windows 95 virtual machine
it used to. I would suggest that if the copy of Windows you're using doesn't let you input an invalidly long length for your pings, it may be a patched version. See if you can find one that lets you enter in an invalidly long length... more likely to be vulnerable.
Feb
20
awarded  Yearling
Feb
20
comment Ping Of Death reconstruction against a Windows 95 virtual machine
Can you try sending between Windows 95 VMs? I know that in Windows 95 it was as simple as ping -l 65510 [victim]. I also remember this trick having mixed results on Windows 95 and NT 3.5 - some systems would crash, some wouldn't, and there didn't seem to be much rhyme nor reason to why one system was invulnerable, and another wasn't. (So, maybe you're not doing anything wrong and your VM's just not vulnerable to the PoD.)
Feb
20
revised Is it possible to hack my encrypted session and hijack the session by electromagnetic waves?
Added preface.
Feb
20
awarded  Commentator
Feb
20
comment Is it possible to hack my encrypted session and hijack the session by electromagnetic waves?
Frankly, you should be much more worried about other attack vectors (as stated at the end of my answer), but if you feel like making #2 and #4 more comprehensible, so that I can understand what you're asking, I'd be willing to update my answer to attempt to answer them.
Feb
20
answered Is it possible to hack my encrypted session and hijack the session by electromagnetic waves?
Feb
20
awarded  Scholar
Feb
20
accepted Do keyfiles actually add any meaningful security in the presence of strong passwords?
May
30
comment Can unencrypted keys & logins be kept out of program memory?
Additionally, Homomorphic Encrpytion might be of some interest to you.
May
30
comment Do keyfiles actually add any meaningful security in the presence of strong passwords?
@Adnan Yeah, I did read that question you linked when searching for an answer to this, but it seems to me like keyfiles as "something you have" don't serve that function any better than a second password - generate and record a random, maximum-character-length password (or put it into a YubiKey), store it offline, and... you've created a keyfile without using keyfiles. Right?
May
29
asked Do keyfiles actually add any meaningful security in the presence of strong passwords?
Sep
23
awarded  Student
Sep
23
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
Thanks. Good advice. I should just get the data I'm responsible for to a more secure location and move on. It will probably be on the media and courts to handle soon enough anyway.