Reputation
510
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 12
Newest
 Yearling
Impact
~19k people reached

Aug
21
comment What is the argument for the fairly prevalent “No more than n repeating characters” password rule?
These policies are implemented. Google maximum number repeating characters in password and you find several. And yes sometimes people go completely over the top setting policies, without apparent reason.
Aug
18
comment How would I encrypt something like this;
Related: softwarerecs.stackexchange.com/questions/17135/…
Jul
30
comment How can I keep Google from tracking me?
Did you install all these security measures after you have been running Google services unprotected, or are they present from day 1?
Jun
2
comment Random URL string: What kind of attack is this, and what can be done to stop it?
@levelonehuman If you find out more I suggest you write an asnwer to your own question (or at least make an edit to your question).
Jun
2
comment Random URL string: What kind of attack is this, and what can be done to stop it?
If you Google for inurl:"x(1)s" you'll see that there are obviously many systems using this pattern (I get 11 million hits). This would indicate it is not 'just' fuzz testing. Many of them lead to .aspx pages. I don't know enough of these, but maybe this is a starter for an answer from someone more knowledgeable.
Apr
30
comment Are these access.log entries successful wordpress login attempts?
One thing I imagine you could do is monitor new WP users - I can imagine someone getting in immediately creating a backup account. But this is no guaranteed way, of course, and will not work if you allow registrations. At least it's something, and there's probably already a mechanism or plugin for warning you.
Apr
30
comment How to check if my usb drives are vulnerable by BAD USB
Mark pointed out that only one chip type is vulnerable Only one? Can you edit and add a reference link?
Apr
30
comment How to check if my usb drives are vulnerable by BAD USB
Adam Caudill and Brandon Wilson demonstrated Bad USB at Derbycon and put their exploit kit up on GitHub. Maybe you can use that code or someone develop a tester based on it?
Apr
30
comment Are these access.log entries successful wordpress login attempts?
@user4668401 Any logins - how would you distinguish the valid ones from the succesful hacks?
Apr
16
comment Why is my Positive SSL certificate deemed insecure by Google Chrome?
Actually, there is nothing wrong with SHA-1 certificates yet. Google decided to pre-emptively build this into Chrome. It would've been the smart move to start these warnings for the same cutoff date as Microsoft does (1 January 2017), but these two are not the best of friends it seems.
Feb
6
comment I can't access websites that use HTTPS, instead getting the message “your connection is not private”!
Could also be that the ISP wants to inject Javascript into all traffic instead of just HTTP, for tracking and advertising purposes. ISP in the US are doing that. Just as bad IMHO
Jan
6
comment Is forcing users to use a strong password effective?
Your scheme would prevent me from using a stronger password than what you sypply (e.g. a 20 char generated Lastpass password). You would receive a strongly worded email if I was one of your users.
Dec
31
comment Does cynicism have a valid role in information security?
"to always assume that the credentials have been compromised" is not cynicism (check the dictionary). I suggest you edit your question and use a different term. Paranoia maybe?
Dec
18
comment Things to remember while building a password manager
Download and read about the ones that already exists, like KeepPass or Password Safe
Nov
27
comment Using unique email address for online signups?
A technique that people sometimes use in order to have not too many (to remember/store) email addresses: use separate addresses for important logins, use one for the many other less important sites (forums, blogs...)
Nov
15
comment Is SHA1 weak for SSL?
Extended discussion about the Google move in Security Now ep. 473 grc.com/securitynow.htm
Oct
29
comment Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method
You can make that an answer (answer your own question) - then it is more obvious to others that there is an answer. You can even mark it as the correct answer after 48 hours.
Sep
17
comment Security of a Random Password
@Curious I get the impression that you have asked this answer only to get confirmation for your assumption (that a 15-char random PW is good enough) instead of really understanding the comments and answers. NO, there are circumstances where it's not good enough. 'In case of database breach' depends very much on how well that DB stored the PWs. Actually, there are so many different scenarios that your question could be seen as 'too broad'.
Sep
14
comment Tiny USB sticks
Why not fill an ordinary USB stick with plain text files that cannot be infected, leaving only a kilobyte? It's highly unlikely that a virus will make room for itself by deleting files. Maybe that leaves the possibility of a boot sector infection, I dunno (does a USB stick have one?)
Aug
25
comment Brute force alphanumeric password using JohnTheRipper
I remember doing this yeeeeeaaaars ago with a very simple Turbo Pascal program I wrote that called unzip with each possible password. Maybe that's an option, just add some logging and the next morning you have your hit.