6,120 reputation
727
bio website
location
age
visits member for 2 years, 4 months
seen Dec 24 at 20:54

Dec
19
answered How secure is an Activation Email?
Dec
14
reviewed Approve Is HTTPS over UDP secure?
Dec
11
comment SQL Injection solutions
Parameterizing queries addresses only the single problem of SQL injection. Sanitizing input by restricting it to a whitelist can help address all kinds of generic injection problems, including XPath and SQL injection, directory traversal attacks, and other application flaws. A responsible approach needs to apply both solutions: parameterized SQL plus whitelisted input. It sounds like Scarl's professor is more focused on blacklisting input via filters, which is pretty old-school, and he or she probably could take a more current approach.
Dec
10
comment Pronounceable Password Generator
Just to add to this, remember that there is no requirement that you use the exact output of any pwgen. For example, Xiong's generator just created "rairchry tontecul", which I would transliterate into real, memorable words, creating a more usable pass phrase of "rain cherry Tonto cull". It's just another way of quickly arriving at the same results provided by the "correct horse battery staple" method.
Dec
10
comment Security risks of disabling SSID Broadcast
The question you seem to be asking presumes that SSID visibility in isolation from everything else impacts security, but it doesn't. It's only a factor in combination with an unsecured network, at which point it places any clients who trust it at risk. And that risk can be mitigated through use of a VPN, at which point you're karmically stealing free wifi from the attacker.
Dec
10
comment Security risks of disabling SSID Broadcast
You're correct, it will not connect if the encryption (and key) doesn't match; but it doesn't matter if the SSID was broadcast or not. My point is there is no way you can configure your SSID to fix a problem caused by clients that already trust "StarbucksFreeWiFi" (other than to not force your clients to use an unauthenticated wireless network connection.)
Dec
9
answered Security risks of disabling SSID Broadcast
Dec
1
reviewed Leave Open VPN Tunnel Routing Question
Dec
1
reviewed Close Suspicious files in my Windows
Dec
1
reviewed Leave Open Cannot get simple shellcode runner to work
Dec
1
reviewed Approve Is SSL dying? Should I buy SSL certificates for my sites any more?
Nov
28
answered Separate normal traffic
Nov
28
comment Separate normal traffic
Every way that is known to identify "normal" from "malicious" traffic already exists as rules in Snort and other intrusion detection systems. If malicious traffic was that easy to identify, it would be equally easy to block, and we wouldn't have malicious traffic. Therefore, there won't ever be such a tool or method.
Nov
22
comment How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
If you have no threat model, then you have no basis for any argument. Someone "took away" your encryption, and now you seem upset, it seems like you are upset mostly because you think you lost something of value. And you keep arguing against people who are trying to help you understand why it's not as important to the end users; and now you are even blaming "IT for being lazy." Please go reread all the posts with a fresh eye.
Nov
20
comment Safe to disable UAC?
Also, look at other ways to approach the problem. Why does the logged in user need to be an admin? Can the logged in user just be a normal user, and post signals to a separate admin task to do the needed admin stuff?
Nov
20
comment How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
WiFi encryption protects the local network from rogue connections, and local-to-local packets from being viewed. It protects the clients from packet sniffing on the WiFi segment, but offers no protection beyond that. Someone on the campus' network, the campus' ISP, or anyone else on the internet can potentially sniff it at any other point. It's like an armored fig leaf that doesn't prevent viewing from the wrong angles.
Nov
20
comment How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
I'm not missing what you're asking, I'm saying that what you're asking for provides only a false sense of security.
Nov
19
answered How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
Nov
19
comment In what situations does parameterizing a query NOT prevent SQL Injection?
Good answer. It's also possible to insert malicious data that performs other forms of injection, such as XPATH or XSS.
Nov
19
answered Safe to disable UAC?