900 reputation
25
bio website
location Australia
age
visits member for 2 years, 6 months
seen yesterday

An IT security manager who still loves coding and problem solving. After over 20 years, still trying to master the craft of writing reliable, clear, concise and elegant code.


Apr
16
answered Source code as password
Apr
16
comment Why does the user pick the password?
I think this answer points out some very good/important points. We in IT often put our needs in front of the user needs. It is far better to let the user choose a password they are comfortable with and meet their security requirements. The other point to consider is how difficult it is to actually create a system which generates 'random' passwords that are user friendly (i.e. rememberable) AND don't exhibit a bias/pattern which could result in overall weaker security should someone guess the pattern
Apr
9
answered Should a website limit characters that can be entered in its fields?
Apr
2
answered Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
Apr
2
comment Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
Passwords are usually hashed and not encrypted, which is a 1 way function. You don't 'decrypt' them. You verify by hashing what the user inputs as the password and comparing that to the hashed version which is on record. This means the risks are different. Understanding this difference is a prerequisite for assessing whether maintaining a history of password hashes is possibly a risk
Mar
26
answered How can a very small company handle PCI-DSS requirement 6.4.2?
Mar
26
answered What is the key when the client want to get a session id in SSL
Mar
26
answered Hide the fact of e-mail communication
Mar
19
answered Historical events in terms of risk assessment
Mar
19
answered Evading IDS in exploit development
Mar
19
answered Can an old operating system webserver be made secure?
Mar
12
answered Is sending passwords through cellphone text messages secure?
Mar
12
answered Is it legal to start a private website for you and your friends to hack?
Mar
5
answered “Secure” third-party inbox
Mar
5
answered Possibility to sniff HTTPS traffic on devices without installing a certificate
Feb
22
comment Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN
What is most important is to match the product with your requirements. To do this, you need to look at what your risk profile is (i.e. likelihood of someone trying to do something bad and consequence should they do it). Then find the product within your resource limits which will provide the right balance. There is no absolutes here and you will never have 100% protection. It is also estimated that 70% of security holes are caused by misconfiguration. Often it is better to have less sophisticated and correct than very sophisticated and wrong
Feb
22
answered Issues with using TLS Session Id for Web App Session?
Feb
22
answered Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN
Feb
13
comment Session Hijacking through sessionId brute-forcing possible?
Yes, the random token used as an anti-forgery protection is a good example. The point to note is that you don't just rely on the session cookie. You can use other information available in the headers and form fields as well as doing things like limiting the lifetime of the session cookie.
Feb
13
comment Login account check
No, this is rarely the way it is done. Normally, if you are going to do this check, you also want to check that the person using that email is the owner, iin which case, you would normally send a confirmation email tot he address with a link. The user must confirm using that link before the account is activated