453 reputation
25
bio website
location Australia
age
visits member for 2 years
seen Nov 28 '13 at 22:10

An IT security manager who still loves coding and problem solving. After over 20 years, still trying to master the craft of writing reliable, clear, concise and elegant code.


Oct
11
awarded  Yearling
Sep
24
awarded  Autobiographer
Nov
21
answered Managing and deploying web app passwords
Nov
21
comment How secure is NOPASSWD in passwordless sudo mode?
One other aspect to consider with respect to using NOPASSWORD is that it removes one very useful control. If access requires a password, you can centrally restrict access to everyone/everything by changing the password. This is not as useful if scripts all sudo to root. However, with good partitioning of authorisation into different accounts, can be quite useful.
Nov
14
answered What is a good way to be alerted of major security patches for software I use?
Nov
14
answered Cryptography that looks like ordinary email
Oct
11
awarded  Yearling
Sep
20
answered How To Track Down Who Initiated A Remote File Transfer Via TeamViewer If I Have Log File
Sep
7
comment Does a maximum length of password mean non-hashed storage?
A frequent reason to see this in some business/enertprise systems is because, if the organisation wants unified passwords across systems, they have to cater for the smallest common denominator. In this situation, you cannot imply a lot regarding how the password is stored or what limitaitons may exist.
Aug
2
answered Why did my provider reset my password after someone else attempted to gain access to my account?
Jul
18
comment Should a site have SSL if it doesn't have a login form?
Forget about the email stuff. SSL/TLS does NOT improve email security by any significant amount. What it does is provide some protection for your username/password with accessing imap/smtp server. Most email servers DO NOT used encryption between servers and you have no control or knowledge of what servers an email message passes through in its route from one server to another. Email is essentially insecure unless you manually encrypt the data yourself and use something like PKI
Jul
18
comment Should a site have SSL if it doesn't have a login form?
This answer shows confusion regarding secure email (which is an oxymoron anyway)
Jul
18
comment Should a site have SSL if it doesn't have a login form?
Also agree. These days, there are few legitimate reasons not to just use SSL. In my experience, security flaws are often found in sites with mixed SSL and non-SSL configurations because of either a config error or soemething being accessible from the non-SSL site by mistake. When SSL represented significant processing overhead, it was worthwhile having content split between SSL and non-SSL. However, this is less justified and given you already havve sensitive info (job apps), SSL would make sense.
Jul
18
answered Most secure way to partition linux?
May
29
answered How to avoid scripts with hardcoded password?
Apr
27
comment How to find out the IP address of email sender in Gmail
But it still may not tell you anything. For example, some ISPs will make all email go via a proxy, so all messages from that ISP will have the same IP. Many ISPs recycle IP addresses, so each time you conect, you get a different IP address.
Apr
27
answered How can I circumvent the lack of Java updates?
Apr
27
awarded  Commentator
Apr
27
comment Can robots.txt for your face be made effective?
BTW, not to mean I don't believe it is a problem. There is a real issue here, but not just due to google glasses. Already, our face is being photographed multiple times every time we go into public space.
Apr
27
comment Can robots.txt for your face be made effective?
Should be noted that robots.txt does not enforce anything. Polite web crawlers will honor it, but there is no requirement to do so. Likewise, polite people don't take your photo without asking. Polite people are not the problem.