45 reputation
4
bio website
location
age
visits member for 2 years
seen Aug 4 at 18:09

Dec
16
comment How much security information to publicise?
The independent report is a very good idea, I may make that part of our process - an annual independent review. Thanks.
Dec
16
comment How much security information to publicise?
Yes, I'll definitely take that approach re PCI. Actually, we don't hold any credit cards, but we do hold bitcoin wallets so are voluntarily doing our PCI mainly for 'user confidence', actually looking at some of the PCI Approved Vendors gives me some bullet points ready to use. I will also bring in an independent auditor as per yours and Rorys suggestion (and to be honest, it would be a good idea anyway).
Dec
15
asked How much security information to publicise?
Oct
18
comment Additional security for WebRTC/DTLS-SRTP with PGP?
Great, thank you. In my case, PGP is known and shared prior so seems to be a good use case. Thank you for your assistance and understanding.
Oct
18
awarded  Supporter
Oct
18
accepted Additional security for WebRTC/DTLS-SRTP with PGP?
Oct
18
comment Additional security for WebRTC/DTLS-SRTP with PGP?
Thank you for your excellent answer. I have two follow ups... 1. Would a benefit of using PGP for authentication be that you can also verify the other ends identity? More trusted than self signed and arguably more trusted than CA signed now days (post lavabit). You may not know the person you are dealing with, but you know their public key is at least who you believe to be the person you are contacting. 2. Is there a downside to using PGP instead (in a closed environment where compatibility isn't required), the RFC appears to suggest no additional issues?
Oct
17
awarded  Editor
Oct
17
revised Additional security for WebRTC/DTLS-SRTP with PGP?
Tidying up formatting.
Oct
16
asked Additional security for WebRTC/DTLS-SRTP with PGP?
Aug
20
awarded  Student
Aug
16
awarded  Scholar
Aug
16
accepted Drupal Security & Two DBs
Aug
15
comment Drupal Security & Two DBs
The most they would get from the main database would be the users name and email. Their phone numbers, addresses, assets (computers etc), invoices and even individual comments for jobs etc are all in separate nodes so actually I really don't see how it would be useful to them. That said, I was thinking about the performance impact more and I think you're right, it would be too slow, for the moment anyway.
Aug
15
comment Drupal Security & Two DBs
You make very good points, even if it was true that the information couldn't be used, it still wouldn't make good press. We all know if there is anything technical to say about something it'll just be lost in the rest of it. We do a lot of what you mention already but I am always looking for better processes and security so we'll reappraise it again. Thanks!
Aug
14
asked Drupal Security & Two DBs