2,100 reputation
516
bio website
location
age
visits member for 2 years, 11 months
seen Jun 30 at 5:19

just a guy who spends all of his time on the computer


Jan
7
comment Is there a nmap command to get the top # most common ports?
If you are interested in doing hardening, you should be whitelisting specific ports you need open, instead of scanning with nmap, checking the results, and changing your configuration that way.
Dec
28
comment Would this generated CSRF token be considered cryptographically strong?
with your scheme you can just generate random bytes, store it in the session, and use that....You don't need any advanced schemes. Lots of sites use advanced schemes when storing and looking up CSRF tokens causes significant overhead (think billions of state changing requests).
Dec
24
comment Would this generated CSRF token be considered cryptographically strong?
You also should talk about how you are verifying this token. Lots of better secure schemes exist but generating a random number and throwing it in your session is plenty secure enough
Dec
23
comment guidelines for password managers
"Enterprise Password Managers do exist", like LastPass...? It's software. All software is going to have bugs. I've never heard of the PW Manager you linked to is the opposite of a service I would purchase to reduce my company's risk (hiring Sales in USA and engineering in India).... "Networks go down" so do internal networks and internal services. AFAIK, all of the big name commercial cloud PW managers cache locally, so this is not an issue for them.
Dec
20
comment Good password hashing algorithm compatible with PHP and Linux apps
Just use bcrypt
Dec
18
answered Is HTTPS redirecting to HTTP a vulnerability?
Dec
15
comment prevent session hijacking in PHP
It sounds like you are vulnerable to SQLi then. If the username contains sql code, it will run if concatenated in like youre doing.
Dec
15
answered prevent session hijacking in PHP
Nov
16
comment Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?
@Curious last pass had a press release that the bugs in this paper were fixed long before the paper was published. blog.lastpass.com/2014/07/a-note-from-lastpass.html
Nov
12
comment Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?
@Curious and if Microsoft/Apple/Richard Stallman/Whomever is malicious they can access all your data too. You can audit the website or the lastpass command line interface to determine how it works and whether or not you feel comfortable using it.
Nov
5
comment Similarity comparisons with hashed passwords possible?
Oh I somehow missed that. I've seen companies pre-compute similar hashes and store them. The short answer is nobody knows but the server admins...but it is possible that they are plaintext
Nov
5
comment Similarity comparisons with hashed passwords possible?
They could just be storing the last 8 hashes...
Nov
4
comment My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do?
schroeder, you can always sue. However to win a negligence suit one needs to prove an actual loss
Sep
24
awarded  Autobiographer
Sep
24
awarded  Custodian
Sep
24
reviewed Reject Why does malware periodically check google.com
Sep
24
reviewed Approve Four-factor authentication
Sep
4
comment Does public key encryption/decryption speed actually matter?
It sure matters when you have billions of connections...The computational overhead adds up.
Sep
4
comment Is information security based entirely on mathematics
Encryption is not the only aspect of information security. Information Security is very broad and there are tons of InfoSec things that have nothing to do with math. How much math do you need to secure a network. Probably not much. If you go down deep enough, everything is a 1 or a 0, but that doesn't mean computer problems are math problem.
Aug
1
awarded  Yearling