meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 2 years, 3 months |
| seen | Apr 13 '12 at 20:02 | |
| stats | profile views | 10 |
|
Feb 10 |
awarded | Yearling |
|
Feb 18 |
comment |
Wireless Access Point security with TEW-638APB I haven't used your particular model, but generally you would make routing rules based to drop packets destined for internal addresses. Internal IPs are defined in RFC1918 (10/8, 172.16/12, and 192.168/16) |
|
Feb 17 |
answered | Wireless Access Point security with TEW-638APB |
|
Feb 17 |
comment |
Reference implementation of C# password hashing and verification To my knowledge, FIPS has not approved any method for password storage. FIPS 800-3 defines secure hashing, but basically just says "use SHA1 or SHA2". As far as the government is concerned, bcrypt and scrypt are just academic. |
|
Feb 14 |
awarded | Quorum |
|
Feb 13 |
comment |
Reference implementation of C# password hashing and verification MD5 is quite broken. Here are some examples, including benign and malicious programs with the same MD5 hash, and two different programs with the same Microsoft Authenticode signature: mscs.dal.ca/~selinger/md5collision It's not a huge leap to .iso files. If you want to prevent inadvertent changes like transmission errors, MD5 is just fine, but that's about it. |
|
Feb 13 |
comment |
Reference implementation of C# password hashing and verification I learn something every day. FWIW, it seems like ToLowerInvariant() is equally valid. |
|
Feb 13 |
comment |
How useful is CISSP to a recent graduate? +1 to Alex. While certifications are no substitute for real-world experience, the CISSP is almost always only going to help in an interview. |
|
Feb 13 |
comment |
How useful is CISSP to a recent graduate? As I understand it, the 2 year recommendation is just that: a recommendation. It is not a requirement. If you have serious studied IT security and cryptography in your undergrad courses, you probably know enough to sit for the exam right now. That said, it's worth flipping through one of the books first, and maybe taking a practice exam to see where you are. |
|
Feb 12 |
comment |
What should I ask a prospective security consultant? I think this depends on what kind of consulting you're talking about. Application security, business continuity, network infrastructure, policy consulting, etc. These are vastly different, and warrant different kinds of questions. |
|
Feb 12 |
comment |
Reference implementation of C# password hashing and verification Any case elimination function will work in the general case. I'll be the first to admit that I'm no expert in i18n, so I'd love to hear more about why ToUpperUnvariant() is better. In this case it probably doesn't matter much, because you're comparing two strings typed by the same person. Presumably, they typed it the same way both times. |
|
Feb 12 |
awarded | Teacher |
|
Feb 12 |
answered | What chars should I not allow in passwords? |
|
Feb 12 |
awarded | Supporter |
|
Feb 12 |
answered | How useful is CISSP to a recent graduate? |
|
Feb 12 |
answered | Reference implementation of C# password hashing and verification |
