639 reputation
1514
bio website tcpiplab.com
location Southern California
age
visits member for 2 years
seen yesterday

IT Security, web development, Perl, Mac, etc.


Oct
21
comment How can I avoid putting the database password in a perl script?
Given that we don't have very many database user accounts to manage, and given that my script only needs to run three different queries, I'm thinking that I'll create a database user that can only run three stored procedures, as you recommended. But I'll require that user to log in with a password. That, in concert with the config file and reversible encryption, will let me sleep at night. I much prefer layers of security, especially in systems that run automatically, so might get forgotten over time. Thank you again.
Oct
21
comment Is there any security value of creatively naming folders containing sensitive files?
+1 for coming up with a use case where security through obscurity might possibly succeed in defeating an attacker (nosey little sister). :)
Oct
21
comment Is there any security value of creatively naming folders containing sensitive files?
Well, explaining that should really just be step one in answering a question like this. A blanket dismissal of security through obscurity has an attached danger too. If a person has the idea that it is all the security they need, which is what your answer is trying to address, then that person will probably be out of ideas after your comment. A person who believes that this is a good way to secure data really needs some new information about how to properly secure their data, not just a dismissal of their naïveté.
Oct
20
comment How to encrypt database connection credentials on a web server?
Excellent answer. +1 for mentioning ASP.NET's optional encryption of web.config. I agree that a downvote without commentary is unhelpful. Perhaps it got down voted for the confusing paragraph beginning with "A second benefit...".
Oct
20
comment Seeding GPG keygen with a hashed secret
When you say, "...using a hashed password as the seed for GPG's key generator", do you mean that you'd enter that hash as the password that you're asked to enter during the gpg --gen-key interactive dialog? Or do you mean that you'd somehow use that hash as the random seed that GPG needs during the actual key generation?
Oct
20
comment Why does the OpenSSH client on Mac OS X silently launch an ssh-agent for the user?
I found that the only way to cause OS X to once again ask for the key password was to reboot the macbox. However, later I discovered that what is happening is that whenever you call /usr/bin/ssh, the OS uses launchd to spawn an instance of /usr/bin/ssh-agent and sets your shell to have an environment variable called $SSH_AUTH_SOCK, which is, according to the manpage for ssh-agent, a normal part of using an ssh-agent. I just had never used ssh agents and never intended to. Is this a Mac-only thing?
Oct
18
comment How secure are passwords made of whole english sentences
Excellent points made by PrashantGupta. Another aspect of this is that, if a password hash is assumed to require e.g., 10,000 hours to crack by brute force, that duration is the best case scenario. It assumes that the successful guess will occur at the end of the 10,000th hour of the cracking effort.
Oct
18
comment Is there any security value of creatively naming folders containing sensitive files?
Excellent answer because it points out that security through obscurity, while being disastrous as a single security control, can be a helpful enhancement in a properly layered security system. We really should stop simply repeating that security through obscurity is bad. It lowers the usefulness and scope of a discussion about security.
Oct
14
comment Is a password easier to brute force if it contains a repeating pattern?
It now occurs to me that, although it sounds like the mathematical assertion would be true, a patterned password would have a much smaller keyspace. For simplicity, lets assume that you've got two passwords made up of only the five vowels, upper or lowercase. That makes 10 possible letters. The patterned password, with a four character pattern, would, if the pattern were repeated five times, be a 20 character password with a keyspace of (10^4)*5 = 50,000 combinations. But a 20 character password, even if constrained to 10 possible characters, would have 10^20 combinations. Sound correct?
Sep
21
comment How can I avoid putting the database password in a perl script?
OK. Then if root is the only user that can access the password file, then this line (that you typed) must be run by root, right? <code>PASSWORD=cat passwd_file perl_script.pl</code> But running the script as root is a bad idea. So I'm missing something here.
Sep
21
comment How can I avoid putting the database password in a perl script?
Thanks gowenfawr. Excellent point about the added complexity. I've always believed that security controls are less effective as system complexity increases.
Sep
21
comment How can I avoid putting the database password in a perl script?
This sounds like a good idea: "this is a general recommendation: don't have executable programs owned by the user that runs them", but I'm not clear on why it is a good idea. What attacks does this prevent?
Sep
21
comment How can I avoid putting the database password in a perl script?
By the way, I can't find a URL pointing to any general, authoritative reference on the web for Time Based Access Control. Cisco routers still support it, and it used to be used in large dial-in modem pools for corporate and government systems. But I think it is generally a phenomenon of 20th century mainframe security systems. I think that the concept back then was something like, "Legitimate users would never dial in to the mainframe outside of normal business hours". But I don't think I've ever seen it used for controlling intra-system file access.
Sep
21
comment How can I avoid putting the database password in a perl script?
This sounds OK, but I don't see how it is any different than just storing the password in a text file separate from the main script, and having the script read the password that way. In your method, the owner of both scripts is the same or at least has the same level of permissions on the two files, right?
Sep
20
comment How can I avoid putting the database password in a perl script?
Great answer. Thank you. One bit of good news is that there is no webserver involved in any of this. I like the idea of a combination of your first two methods: config file + encrypting the password. They are more specific versions of some fuzzy ideas I was thinking about.
Aug
22
comment How useful or beneficial is participating in CTF contests for my security career?
Oh ya, for clarity I should add that I'm referring specifically to live CTF contests, not the website-only CTF sites where you log in and hack at your leisure. I'm thinking about the type of CTF contests they have at DefCon, DerbyCon, etc. --Thanks.
Aug
20
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
Update: Thanks to Andy Smith's comment, above, I went with the free basic domain validation certificate from startssl.com. The request process, and delivery, everything, worked as expected. But I must say that their web interface was exceedingly slow and clunky. But the certificate is recognized in 99% of all browsers, like certs from most CAs.
Aug
9
comment wireless: Jamming or interference?
Anecdotally, I've had good luck choosing channel 11 in congested areas. Don't know why that is.
Aug
8
comment Password resets - what practices should web services follow?
But be ready for the more cumbersome steps at the end, wherein you generate a separate password of 16 random lowercase characters for each non-browser app that will access your Gmail account, e.g, Outlook. So the more apps you have accessing your Google account, the less likely you'd be to ever change your Google password.
Aug
8
comment Password resets - what practices should web services follow?
I just now set up the 2-factor authentication settings offered by google at the link you provided. It is an excellent system, with an easy set up process: SMS to your phone for a one-time code for authorizing an unknown computer to access your Google credentials, etc.