376 reputation
16
bio website
location
age
visits member for 3 years, 8 months
seen Oct 16 at 14:19

Sep
30
awarded  Critic
Feb
16
awarded  Nice Answer
Jul
14
awarded  Nice Answer
Feb
10
awarded  Yearling
Feb
18
comment Wireless Access Point security with TEW-638APB
I haven't used your particular model, but generally you would make routing rules based to drop packets destined for internal addresses. Internal IPs are defined in RFC1918 (10/8, 172.16/12, and 192.168/16)
Feb
17
answered Wireless Access Point security with TEW-638APB
Feb
17
comment Reference implementation of C# password hashing and verification
To my knowledge, FIPS has not approved any method for password storage. FIPS 800-3 defines secure hashing, but basically just says "use SHA1 or SHA2". As far as the government is concerned, bcrypt and scrypt are just academic.
Feb
14
awarded  Quorum
Feb
13
comment Reference implementation of C# password hashing and verification
MD5 is quite broken. Here are some examples, including benign and malicious programs with the same MD5 hash, and two different programs with the same Microsoft Authenticode signature: mscs.dal.ca/~selinger/md5collision It's not a huge leap to .iso files. If you want to prevent inadvertent changes like transmission errors, MD5 is just fine, but that's about it.
Feb
13
comment Reference implementation of C# password hashing and verification
I learn something every day. FWIW, it seems like ToLowerInvariant() is equally valid.
Feb
13
comment How useful is CISSP to a recent graduate?
+1 to Alex. While certifications are no substitute for real-world experience, the CISSP is almost always only going to help in an interview.
Feb
13
comment How useful is CISSP to a recent graduate?
As I understand it, the 2 year recommendation is just that: a recommendation. It is not a requirement. If you have serious studied IT security and cryptography in your undergrad courses, you probably know enough to sit for the exam right now. That said, it's worth flipping through one of the books first, and maybe taking a practice exam to see where you are.
Feb
12
comment What should I ask a prospective security consultant?
I think this depends on what kind of consulting you're talking about. Application security, business continuity, network infrastructure, policy consulting, etc. These are vastly different, and warrant different kinds of questions.
Feb
12
comment Reference implementation of C# password hashing and verification
Any case elimination function will work in the general case. I'll be the first to admit that I'm no expert in i18n, so I'd love to hear more about why ToUpperUnvariant() is better. In this case it probably doesn't matter much, because you're comparing two strings typed by the same person. Presumably, they typed it the same way both times.
Feb
12
awarded  Teacher
Feb
12
answered What chars should I not allow in passwords?
Feb
12
awarded  Supporter
Feb
12
answered How useful is CISSP to a recent graduate?
Feb
12
answered Reference implementation of C# password hashing and verification