22,906 reputation
21856
bio website
location Troy, NY
age 29
visits member for 1 year, 7 months
seen 3 hours ago

Feb
12
comment does any botnet/malware traffic use ssh or anything else other than TCP/IP?
SSH, FTP, TFTP etc use TCP/IP.
Feb
12
comment Revoke decryption capability
KEK being the key the user has, Data Encryption Key being the key used on the actual data.
Feb
12
comment Resetting passwords howto
Making their lives harder rarely works in the benefit of their security or the security of your system. If they understand the need, they will follow it without a requirement. If they don't, they will fight you tooth and nail for making their life difficult and they will not be thinking of how to maximize security while keeping difficulty down.
Feb
12
comment Resetting passwords howto
in that case, it may be sufficiently sensitive to assign passwords, though I would still suggest having relatively relaxed requirements but explaining the importance of choosing a secure and unique password. Fundamentally, you can't be responsible for what level of safety someone takes with their password. You can only deal with how well you protect it. Use complex hashes with numerous iterations. It will make login take longer but will also make it harder to compromise even simple passwords. Users have to be invested in trying to secure their information as well.
Feb
12
comment Resetting passwords howto
As many users become more security conscious, they at least come up with a few passwords that they can remember that are hard to guess and maybe even a system of passwords so that it isn't easy to use a password across multiple sites, but if you make it so their system breaks down, the vast majority will come up with the absolute simplest password they possibly can to meet your requirements.
Feb
12
comment Resetting passwords howto
Fundamentally you either have to assign secure passwords (which would be even more unpopular, to the point people would consider different services) or trust users to choose secure passwords. You can't force a user to choose a secure password.
Feb
12
comment Resetting passwords howto
My experience with 12+ character passwords is that they become less secure. Take for example when my health insurance company required a 12 character password with silly requirements. My password became Fu@kY0uMVP!C# instead of my much more secure and slightly shorter password system that didn't meet there requirements. (And they were not even granting access to anything particularly sensitive with that account.) I'd challenge that 12 characters and complexity requirements isn't going to make people's passwords significantly harder to guess and might actually make them easier.
Feb
12
comment Resetting passwords howto
Let me just comment that the majority of your users are going to hate you for requiring a 12 character password and your reset procedure is going to get a LOT of use, so if you make it too complex, people will literally be cursing your name. Are you certain that the system you are building requires such a high level of security?
Feb
11
comment Will deferring password choice until after account activation improve security?
I get that you can't rely on the session remaining current. I'm saying they should be required to login with the original username and password in order to verify their account if the session isn't still current. The random value may not be easily guessed, but they only have to guess a working value. It would be best to lock each code to a particular user. It may be an acceptable risk to you compared to the usability, but it is a risk (I'll be it a very small one.)
Feb
10
comment Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?
a public key is still just as identifiable as a username or profile, an e-mail address isn't required for a traditional setup. Not needing a password on the server is even possible by using client side certificates with traditional SSL. (This is also similar to how SSH works.)
Feb
10
comment Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?
Ok, so you are basically talking about a server that is not anonymous being used as the center point between a number of anonymous end users? How is this different from almost any online forum? (say SE for example). Each user is still effectively talking to each other and authenticating with each other via an out of band channel, only the server doesn't know who they are. I'm failing to see what you are trying to accomplish with this and why it can't be done through traditional means.
Feb
10
comment Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?
How do you handle an out of band key exchange with an anonymous party?
Feb
10
comment Does my UI need to be secure if my API is?
@Martin - using SSL and protecting against things like cross site scripting issues are a start, but there are a lot of different possible concerns. Making sure input to JavaScript is validated, making sure that it isn't possible to inject markup in to pages via other forms of input, etc.
Feb
8
comment Why can't just any program use his own file-system-access-system?
@KnightOfNi - you are correct. I updated my answer to make that more clear. It was my intention that that be clear, but looking back it wasn't.
Feb
6
comment How can I prevent my database from being compromised if my CakePHP app is compromised?
@symcbean - ah, true, I admit I had only glanced over the highlights of the question. I'd also add then that user encryption keys, protected by password derived keys should be used to store encryption keys that the application server can't access itself if you really want the tin foil hat.
Feb
6
comment How can I prevent my database from being compromised if my CakePHP app is compromised?
If the attacker has local server execute access and db credentials, you are pretty much hosed no matter what unless the entire application logic is written in SQL. You are going to have to restore from backup either way since the state is compromised. If they are able to delete * vs being able to make 1000 delete sproc calls isn't a significant difference in most cases.
Feb
6
comment How can I prevent my database from being compromised if my CakePHP app is compromised?
@symcbean - that's the most intense level of security, though it isn't needed in every case. The main priority for any application should be to ensure the compromise doesn't spread (to other systems). How much the application needs to be self-protecting is an exercise left to the developer based on the needs for the application. Ensuring that the SQL user can't misbehave even when compromised is nice for high security, but putting all your logic in to sprocs and effectively coding in the DB isn't always a worthwhile trade off, particularly if damaging enough sprocs have to exist anyway.
Feb
5
comment Cross-checking Driver's License Against DMV Using MySQL DB or PHP Script?
this assumes that the information is even accessible and if it is accessible, then the answer will be to follow whatever the policies are of the organization providing access to the data. (Most likely a SSL protected web service call.) This is a run of the mill programing question with some government aspects, but nothing security relevant as the implementation of the security will have already been determined for you by the provider. The actual implementation of the client is a programing concern. Hope that helps clarify the scope of the site and good luck.
Feb
5
comment Cross-checking Driver's License Against DMV Using MySQL DB or PHP Script?
This question appears to be off-topic because it is about software development, not security.
Feb
4
comment Contact person by phone, when their phone might have malware
@D.W. I did a complete re-write of the answer to address the points of the discussion a little more clearly.