689 reputation
1514
bio website tcpiplab.com
location Southern California
age
visits member for 2 years, 2 months
seen Sep 17 at 19:28

IT Security, web development, Perl, Mac, etc.


Sep
17
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
This is an excellent answer, made all the more excellent by your inclusion of the users' perception. Perception is an ever present, if unwelcome, aspect of the security posture of any information system.
Aug
8
awarded  Yearling
Jul
26
awarded  Famous Question
Jul
2
awarded  Curious
Mar
2
answered Is jQuery.val() enough to prevent XSS
Dec
3
awarded  Notable Question
Nov
9
awarded  Notable Question
Oct
14
awarded  Good Question
Aug
8
awarded  Yearling
May
8
awarded  Popular Question
Oct
29
awarded  Popular Question
Oct
21
comment How can I avoid putting the database password in a perl script?
Given that we don't have very many database user accounts to manage, and given that my script only needs to run three different queries, I'm thinking that I'll create a database user that can only run three stored procedures, as you recommended. But I'll require that user to log in with a password. That, in concert with the config file and reversible encryption, will let me sleep at night. I much prefer layers of security, especially in systems that run automatically, so might get forgotten over time. Thank you again.
Oct
21
comment Is there any security value of creatively naming folders containing sensitive files?
+1 for coming up with a use case where security through obscurity might possibly succeed in defeating an attacker (nosey little sister). :)
Oct
21
comment Is there any security value of creatively naming folders containing sensitive files?
Well, explaining that should really just be step one in answering a question like this. A blanket dismissal of security through obscurity has an attached danger too. If a person has the idea that it is all the security they need, which is what your answer is trying to address, then that person will probably be out of ideas after your comment. A person who believes that this is a good way to secure data really needs some new information about how to properly secure their data, not just a dismissal of their naïveté.
Oct
20
answered Why are simple packet filter firewalls insufficient for the protection of web applications?
Oct
20
comment How to encrypt database connection credentials on a web server?
Excellent answer. +1 for mentioning ASP.NET's optional encryption of web.config. I agree that a downvote without commentary is unhelpful. Perhaps it got down voted for the confusing paragraph beginning with "A second benefit...".
Oct
20
comment Seeding GPG keygen with a hashed secret
When you say, "...using a hashed password as the seed for GPG's key generator", do you mean that you'd enter that hash as the password that you're asked to enter during the gpg --gen-key interactive dialog? Or do you mean that you'd somehow use that hash as the random seed that GPG needs during the actual key generation?
Oct
20
answered Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
Oct
20
revised Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
edited title
Oct
20
comment Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
I found that the only way to cause OS X to once again ask for the key password was to reboot the macbox. However, later I discovered that what is happening is that whenever you call /usr/bin/ssh, the OS uses launchd to spawn an instance of /usr/bin/ssh-agent and sets your shell to have an environment variable called $SSH_AUTH_SOCK, which is, according to the manpage for ssh-agent, a normal part of using an ssh-agent. I just had never used ssh agents and never intended to. Is this a Mac-only thing?