975 reputation
25
bio website
location Australia
age
visits member for 2 years, 7 months
seen 14 hours ago

An IT security manager who still loves coding and problem solving. After over 20 years, still trying to master the craft of writing reliable, clear, concise and elegant code.


15h
answered Any tools like PuTTY for manually stepping through network communications?
15h
answered What are the best practices for (token based) security in a webapp?
May
16
comment Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?
If they can generate the certificate without you providing the private key, then they have to create it and therefore know it. Yes, guess re same/store, but look at the number of recent failures from companies who have shown exactly this level of stupidity. The point is, you don't know. The vetting was more about the site certs they offer, mentioned as I think it shows a general low trust level wrt the company as a CA. The only reason I can see for using a 3rd party to generate the cert (any class) is about trust. If trust doesn't matter, why bother - do it yourself and know who has the keys
May
14
answered Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?
May
7
comment How to decide “I'll trust this software” for closed-source or precompiled software?
This is a very good answer. I would add that we need to be very careful about assumptions which suggest open source software is more secure/trustworthy than closed source. Things like the openssl failures show the flaws in such assumptions. The key metrics are really your trust in the provider, assessment of the risk versus value and what things you can do, like using a virtual machine, to control those risks to an acceptable level.
May
1
answered JSON Web Tokens - How to securely store the key?
Apr
30
answered Custom socket server on the internet running as root
Apr
16
answered Source code as password
Apr
16
comment Why does the user pick the password?
I think this answer points out some very good/important points. We in IT often put our needs in front of the user needs. It is far better to let the user choose a password they are comfortable with and meet their security requirements. The other point to consider is how difficult it is to actually create a system which generates 'random' passwords that are user friendly (i.e. rememberable) AND don't exhibit a bias/pattern which could result in overall weaker security should someone guess the pattern
Apr
9
answered Should a website limit characters that can be entered in its fields?
Apr
2
answered Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
Apr
2
comment Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
Passwords are usually hashed and not encrypted, which is a 1 way function. You don't 'decrypt' them. You verify by hashing what the user inputs as the password and comparing that to the hashed version which is on record. This means the risks are different. Understanding this difference is a prerequisite for assessing whether maintaining a history of password hashes is possibly a risk
Mar
26
answered How can a very small company handle PCI-DSS requirement 6.4.2?
Mar
26
answered What is the key when the client want to get a session id in SSL
Mar
26
answered Hide the fact of e-mail communication
Mar
19
answered Historical events in terms of risk assessment
Mar
19
answered Evading IDS in exploit development
Mar
19
answered Can an old operating system webserver be made secure?
Mar
12
answered Is sending passwords through cellphone text messages secure?
Mar
12
answered Is it legal to start a private website for you and your friends to hack?