704 reputation
1514
bio website tcpiplab.com
location Southern California
age
visits member for 2 years, 2 months
seen Sep 17 at 19:28

IT Security, web development, Perl, Mac, etc.


Oct
20
asked Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
Oct
18
answered How secure are passwords made of whole english sentences
Oct
18
comment How secure are passwords made of whole english sentences
Excellent points made by PrashantGupta. Another aspect of this is that, if a password hash is assumed to require e.g., 10,000 hours to crack by brute force, that duration is the best case scenario. It assumes that the successful guess will occur at the end of the 10,000th hour of the cracking effort.
Oct
18
comment Is there any security value of creatively naming folders containing sensitive files?
Excellent answer because it points out that security through obscurity, while being disastrous as a single security control, can be a helpful enhancement in a properly layered security system. We really should stop simply repeating that security through obscurity is bad. It lowers the usefulness and scope of a discussion about security.
Oct
14
accepted Is a password easier to brute force if it contains a repeating pattern?
Oct
14
comment Is a password easier to brute force if it contains a repeating pattern?
It now occurs to me that, although it sounds like the mathematical assertion would be true, a patterned password would have a much smaller keyspace. For simplicity, lets assume that you've got two passwords made up of only the five vowels, upper or lowercase. That makes 10 possible letters. The patterned password, with a four character pattern, would, if the pattern were repeated five times, be a 20 character password with a keyspace of (10^4)*5 = 50,000 combinations. But a 20 character password, even if constrained to 10 possible characters, would have 10^20 combinations. Sound correct?
Oct
13
asked Is a password easier to brute force if it contains a repeating pattern?
Sep
21
comment How can I avoid putting the database password in a perl script?
OK. Then if root is the only user that can access the password file, then this line (that you typed) must be run by root, right? <code>PASSWORD=cat passwd_file perl_script.pl</code> But running the script as root is a bad idea. So I'm missing something here.
Sep
21
awarded  Commentator
Sep
21
comment How can I avoid putting the database password in a perl script?
Thanks gowenfawr. Excellent point about the added complexity. I've always believed that security controls are less effective as system complexity increases.
Sep
21
comment How can I avoid putting the database password in a perl script?
This sounds like a good idea: "this is a general recommendation: don't have executable programs owned by the user that runs them", but I'm not clear on why it is a good idea. What attacks does this prevent?
Sep
21
accepted How can I avoid putting the database password in a perl script?
Sep
21
awarded  Autobiographer
Sep
21
comment How can I avoid putting the database password in a perl script?
By the way, I can't find a URL pointing to any general, authoritative reference on the web for Time Based Access Control. Cisco routers still support it, and it used to be used in large dial-in modem pools for corporate and government systems. But I think it is generally a phenomenon of 20th century mainframe security systems. I think that the concept back then was something like, "Legitimate users would never dial in to the mainframe outside of normal business hours". But I don't think I've ever seen it used for controlling intra-system file access.
Sep
21
comment How can I avoid putting the database password in a perl script?
This sounds OK, but I don't see how it is any different than just storing the password in a text file separate from the main script, and having the script read the password that way. In your method, the owner of both scripts is the same or at least has the same level of permissions on the two files, right?
Sep
21
answered How can I avoid putting the database password in a perl script?
Sep
20
comment How can I avoid putting the database password in a perl script?
Great answer. Thank you. One bit of good news is that there is no webserver involved in any of this. I like the idea of a combination of your first two methods: config file + encrypting the password. They are more specific versions of some fuzzy ideas I was thinking about.
Sep
20
asked How can I avoid putting the database password in a perl script?
Sep
20
awarded  Critic
Sep
3
answered What can I do to make sure my computer isn't infected with FinSpy?