Luke Sheppard

484 reputation

bio	website	tcpiplab.com
	location	Southern California
	age
visits	member for	9 months
	seen	Mar 29 at 18:37
stats	profile views	9

IT Security, web development, Perl, Mac, etc.

	484 reputation	bio	website	tcpiplab.com	visits	member for	9 months
13 badges		location	Southern California		seen	Mar 29 at 18:37

summary answers questions tags badges favorites bounties reputation activity

56 Actions

suggestions reviews revisions comments badges posts accepts all

May 8	awarded	Popular Question
Oct 29	awarded	Popular Question
Oct 21	comment	How can I avoid putting the database password in a perl script? Given that we don't have very many database user accounts to manage, and given that my script only needs to run three different queries, I'm thinking that I'll create a database user that can only run three stored procedures, as you recommended. But I'll require that user to log in with a password. That, in concert with the config file and reversible encryption, will let me sleep at night. I much prefer layers of security, especially in systems that run automatically, so might get forgotten over time. Thank you again.
Oct 21	comment	Is there any security value of creatively naming folders containing sensitive files? +1 for coming up with a use case where security through obscurity might possibly succeed in defeating an attacker (nosey little sister). :)
Oct 21	comment	Is there any security value of creatively naming folders containing sensitive files? Well, explaining that should really just be step one in answering a question like this. A blanket dismissal of security through obscurity has an attached danger too. If a person has the idea that it is all the security they need, which is what your answer is trying to address, then that person will probably be out of ideas after your comment. A person who believes that this is a good way to secure data really needs some new information about how to properly secure their data, not just a dismissal of their naïveté.
Oct 20	answered	Why are simple packet filter firewalls insufficient for the protection of web applications?
Oct 20	comment	How to encrypt database connection credentials on a web server? Excellent answer. +1 for mentioning ASP.NET's optional encryption of web.config. I agree that a downvote without commentary is unhelpful. Perhaps it got down voted for the confusing paragraph beginning with "A second benefit...".
Oct 20	comment	Seeding GPG keygen with a hashed secret When you say, "...using a hashed password as the seed for GPG's key generator", do you mean that you'd enter that hash as the password that you're asked to enter during the gpg --gen-key interactive dialog? Or do you mean that you'd somehow use that hash as the random seed that GPG needs during the actual key generation?
Oct 20	answered	Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
Oct 20	revised	Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user? edited title
Oct 20	comment	Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user? I found that the only way to cause OS X to once again ask for the key password was to reboot the macbox. However, later I discovered that what is happening is that whenever you call /usr/bin/ssh, the OS uses launchd to spawn an instance of /usr/bin/ssh-agent and sets your shell to have an environment variable called $SSH_AUTH_SOCK, which is, according to the manpage for ssh-agent, a normal part of using an ssh-agent. I just had never used ssh agents and never intended to. Is this a Mac-only thing?
Oct 20	asked	Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
Oct 18	answered	How secure are passwords made of whole english sentences
Oct 18	comment	How secure are passwords made of whole english sentences Excellent points made by PrashantGupta. Another aspect of this is that, if a password hash is assumed to require e.g., 10,000 hours to crack by brute force, that duration is the best case scenario. It assumes that the successful guess will occur at the end of the 10,000th hour of the cracking effort.
Oct 18	comment	Is there any security value of creatively naming folders containing sensitive files? Excellent answer because it points out that security through obscurity, while being disastrous as a single security control, can be a helpful enhancement in a properly layered security system. We really should stop simply repeating that security through obscurity is bad. It lowers the usefulness and scope of a discussion about security.
Oct 14	accepted	Is a password easier to brute force if it contains a repeating pattern?
Oct 14	comment	Is a password easier to brute force if it contains a repeating pattern? It now occurs to me that, although it sounds like the mathematical assertion would be true, a patterned password would have a much smaller keyspace. For simplicity, lets assume that you've got two passwords made up of only the five vowels, upper or lowercase. That makes 10 possible letters. The patterned password, with a four character pattern, would, if the pattern were repeated five times, be a 20 character password with a keyspace of (10^4)*5 = 50,000 combinations. But a 20 character password, even if constrained to 10 possible characters, would have 10^20 combinations. Sound correct?
Oct 13	asked	Is a password easier to brute force if it contains a repeating pattern?
Sep 21	comment	How can I avoid putting the database password in a perl script? OK. Then if root is the only user that can access the password file, then this line (that you typed) must be run by root, right? <code>PASSWORD=`cat passwd_file` perl_script.pl</code> But running the script as root is a bad idea. So I'm missing something here.
Sep 21	awarded	Commentator