448 reputation
210
bio website none
location Midwest
age 32
visits member for 2 years, 2 months
seen 2 days ago

Just another sad, but unremarkable tale of a bright kid who squandered his potential and ruined his life by turning to a life of IT.

Since first embarking down this dark path, I've done a little bit of everything, from small businesses to large datacenters, Linux to Windows, networking and security, DBA roles and, in my darkest moments, even some light mainframe operations.

These days it's Microsft products paying the bills, for what difference it makes. Whether it's a multi-domain AD environment with tens of thousands of users, a small cluster of Linux webservers, or a tangled web of network cables, systems are all just complex tools to do complex jobs, perpetually in need of someone to make them perform better and ensure they're always available when someone needs them.

Since being a lawyer seemed to boring, being a doctor seemed to hard, and my idea of a good time usually involves using a powerful computer anyway, I really can't imagine doing anything else.


Jun
27
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
Wow, your boss must love you. I, myself, find the urge to hire you almost overwhelming.
Mar
28
comment How do big companies and wealthy people secure their information? And how can I secure mine?
And also, how do large corporations and VIP (billionaires, celebrities, heads of state) individuals secure their passwords? They... don't. Worked for a guy once, owned a decent sized company (and a bunch of smaller ones), with a personal worth of mid-nine figures, and his password for everything was bob. Three guesses what his first name was. Assuming that the rich and powerful actually do security right is a very dangerous assumption. Focus instead on how to do it right, and ignore the mind-numbingly foolish practices of the rich and famous.
Mar
12
comment Is it possible to boot an encrypted server remotely and securely?
No one mentioned out of band management. iLO, iDRAC, etc. Weird.
Feb
21
comment A service that claims beyond army level encryption
<shrug> Achieving "beyond [insert government agency] encryption" is pretty trivial. I use Truecrypt, and use a triple cascade of 256 bit ciphers to protect my data. To my knowledge, no government agency anywhere has an encryption standard that stringent, so anyone with access to a free encryption program can achieve "beyond [insert government agency] encryption" by clicking through a wizard. Doesn't actually mean that data's more secure than the army's, though. Just product marketing to make their service sound impressive and attract customers.
Feb
20
comment Ping Of Death reconstruction against a Windows 95 virtual machine
it used to. I would suggest that if the copy of Windows you're using doesn't let you input an invalidly long length for your pings, it may be a patched version. See if you can find one that lets you enter in an invalidly long length... more likely to be vulnerable.
Feb
20
comment Ping Of Death reconstruction against a Windows 95 virtual machine
Can you try sending between Windows 95 VMs? I know that in Windows 95 it was as simple as ping -l 65510 [victim]. I also remember this trick having mixed results on Windows 95 and NT 3.5 - some systems would crash, some wouldn't, and there didn't seem to be much rhyme nor reason to why one system was invulnerable, and another wasn't. (So, maybe you're not doing anything wrong and your VM's just not vulnerable to the PoD.)
Feb
20
comment Is it possible to hack my encrypted session and hijack the session by electromagnetic waves?
Frankly, you should be much more worried about other attack vectors (as stated at the end of my answer), but if you feel like making #2 and #4 more comprehensible, so that I can understand what you're asking, I'd be willing to update my answer to attempt to answer them.
May
30
comment Can unencrypted keys & logins be kept out of program memory?
Additionally, Homomorphic Encrpytion might be of some interest to you.
May
30
comment Do keyfiles actually add any meaningful security in the presence of strong passwords?
@Adnan Yeah, I did read that question you linked when searching for an answer to this, but it seems to me like keyfiles as "something you have" don't serve that function any better than a second password - generate and record a random, maximum-character-length password (or put it into a YubiKey), store it offline, and... you've created a keyfile without using keyfiles. Right?
Sep
23
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
Thanks. Good advice. I should just get the data I'm responsible for to a more secure location and move on. It will probably be on the media and courts to handle soon enough anyway.
Sep
21
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
contact your employer's security department with the same information Yeah, I contacted my employer's security department, ad it turns out I was as pissed off about this as I was! :) (And probably too busy to do much about it anyway, but still seems like someone should do something about it.)
Sep
21
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
+1, thanks. Definitely what I was looking for along the lines of "what do I do about it," and a good idea about access logging for use of the portal, though I'm not sure if that would help, because I don't think there's any log that we can access from within the portal itself (which even free webmail has these days), but definitely worth a look.
Aug
24
comment Truecrypt Plausible Deniability - Linux
Nah, the molten metal dripping off the hard drives make short work of the RAM. And the motherboard. And the case... the carpet too... like I said, it creates an expensive mess.
Aug
24
comment Truecrypt Plausible Deniability - Linux
Absolutely. I encrypt my drives, just in case, but the true security is 10 ounces of thermite on top of the drives, and a small chemical flare (like a road flare) set to ignite if there's a sudden power loss, such as would happen if the authorities tried to seize my box. Much better security than just encryption and plausible deniability. Does make kind of an expensive mess during power outages, though... and a bit of a fire hazard too. But at least I don't have to worry about stumbling around in the dark when the power dies.
Jul
26
comment Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?
<sigh> eprint.iacr.org/2008/469.pdf A 2008 attack creating collisions in 2^51 operations. And there was news this year (maybe even this month) about it being weakened further, so your statement is blatantly false. SHA-1 is compromised, and essentially insecure. Please be more careful next time, lest you spread dangerously incorrect information around.