917 reputation
212
bio website leviathansecurity.com/blog/…
location Calgary, AB
age 25
visits member for 2 years, 1 month
seen Sep 18 at 6:21

I'm a security consultant (auditor) and security analytics software developer with Leviathan Security Group; when I'm not doing that I also work with Seekintoo on software design and business development, and poke at sysadmin tasks.

I've also done deskside support, retail support, service delivery, and mobile onsite deployment in the past. More interestingly, I've supported, architected, written, and deployed identity and access management solutions end-to-end with Hitachi ID Systems. I can write technical documentation, reverse-engineer things, write software, administer virtualization environments (primarily for dev environment targets), and run linux servers of various kinds.

The languages in which I feel most at home are C++, x86 assembly (of either variant), python, and SPARC assembly, more or less in that order.

I am often out of close votes - but also out of up and down votes.


17h
awarded  Explainer
Aug
15
awarded  Yearling
May
10
answered What happens if my ISP gives me an IP address that's already being used
May
8
comment Paypal sent an email addressing me with one of my old passwords as my name
I wonder what the point of the phishing email is, if they already knew the password?
Apr
25
comment How to get top management support for security projects?
This is the kind of thing you could do with management support as part of a security program (it is similar to test phishing I guess), but you'd need a lot of management support and coordination for it, and it's kind of a bad idea since it has a ton of operational risk. Exposing your business to that risk without management involvement is worse than negligent.
Mar
26
answered True?: “Nearly all encrypted passwords are stored with the last character in clear text”?
Mar
26
comment True?: “Nearly all encrypted passwords are stored with the last character in clear text”?
This is a consequence of using unix crypt() in its traditional form.
Mar
26
comment Can a web server be secured with just a firewall?
There might be an exploit (sure, a "backdoor") in your web server or configuration. So, what I'm saying is, making data come only to your webserver hardly guarantees anything about security. There aren't magic ports that give you domain admin when you connect to them; it's all about exploits in running services.
Mar
26
comment Can a web server be secured with just a firewall?
No, it isn't. Ignore the ideas you have about port 80; it isn't as though data being addressed to that port guarantees anything about it or about how it is processed. And, the data that comes in gets processed by the server in ways that must involve the OS at several levels.
Mar
26
comment Are invalid card numbers under PCI compliance
PCIDSS aside, common sense suggests these numbers be treated as sensitive anyway. It isn't exceptionally difficult to guess what the correct number might have been in the event of a single-digit transposition or an invalid BIN.
Mar
26
comment Can a web server be secured with just a firewall?
It isn't about ports. Individual ports are not particularly special; it's the services that are running. Focusing on ports alone misses the point.
Mar
26
revised Can a web server be secured with just a firewall?
added 27 characters in body
Mar
26
answered Can a web server be secured with just a firewall?
Mar
22
awarded  Organizer
Mar
22
revised EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV
nothing to do with AES; cleanup
Mar
22
suggested suggested edit on EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV
Mar
22
comment EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV
The things are usually written by the cheapest available contractors, installed and maintained and operated by the cheapest labour available (often casual!), and basically never audited. There is little reason to trust them.
Mar
21
comment EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV
Communicating directly with the authorizing server means the POS doesn't need to be trusted in that domain and (more importantly) can't eavesdrop.
Feb
12
awarded  Informed
Feb
12
comment Is Certificate pinning different from CA pinning?
There are lots of ways to do it, and lots of scopes (individual and network, etc.). OWASP gives a good overview: owasp.org/index.php/Certificate_and_Public_Key_Pinning