Reputation
1,264
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
2 6
Newest
 Nice Answer
Impact
~57k people reached

  • 0 posts edited
  • 0 helpful flags
  • 51 votes cast
Aug
28
answered Hashing passwords in OpenLDAP
Aug
28
answered UDP sockets open on all ports
Aug
13
answered Session Identification Hashing - How to make it more Secure and Robust
Aug
13
comment Doesn't hashing passwords server side mean a compromised website could leave passwords vulnerable?
Having access to the code which performs the hashing isn't enough - you still need to know what was input into the algorithm to generate the hash. Also, how would you implement a system to detect a page which was modified by a hacker from a legitimate modificaiton or deal with dynamic pages?
Aug
13
answered Why do phishing emails have spelling and grammar mistakes?
Aug
10
awarded  Nice Answer
Aug
9
comment Are there technical differences which make Linux less vulnerable to virus than Windows?
@user2284570 I don't see how that is relevant. File hierarchies and memory management is the same in principal for both systems. At an abstract level, they are both "classical turing based machines". Each system has various schemes to help detect and protect against stack smashing or out of bounds memory access etc, but these do not change the fundamental architectures. The underlying physical architecture is the same. The OSs are converging more than diverging. Often, at conceptual level, good ideas implemented in one are copied by the other. Similar concepts, just different implementations
Aug
8
comment Are there technical differences which make Linux less vulnerable to virus than Windows?
@user2284570 - no I didn't forget it. As I said, many feel that being based on open source, it is more secure. However, I don't believe this is as true in practice. It assumes "someone" is reviewing the source and has the skills to understand it. This is not necessarily the case - examples exist of both intentional and unintentional security threats in open source. Reality is, very little open source is adequately audited/reviewed. Can be argued access to the source makes it easier to find exploits, making it less secure. Consider the openssl or libc vulnerabilities and how long they existed
Aug
6
comment WiFi Fingerprinting RFC2617 Linux Device Cannot Unauthenticate Unless AP Password Changes
Just a wild guess, but I would check to see if the system is sending back a cookie as part of the http request or a session key which are not cleared unless the AP pwd is changed. I'd dump out all the headers in the response and see if you can see something to give more of a clue
Aug
6
answered Encrypting data before sending to SaaS tool and decrypting on browser view
Aug
6
answered Are there technical differences which make Linux less vulnerable to virus than Windows?
Jul
9
answered Web services API key
Jul
9
answered Distributed tokenization for credit card numbers
Jul
3
comment How are leaked government credentials possible and what's the point?
I don't think the password credentials was the critical issue with the OPM break. The actual data of value was all the other details, such a full name, SN, parents name and most importantly, details of the government security check. Essentially, all the key info you need for effective identity theft or to blackmail government employees etc
Jul
3
answered Can an attacker “simulate” a private IP address?
Jul
2
comment Is possible to get infected by only staying connected to the Internet (nothing else)?
There are no certainties. Even if you have applied all updates you may still be vulnerable to a zero day which the vendor does not know about or a vulnerability which has not yet been patched. All you can do is reduce the risk to a level which is acceptable. What is acceptable depends on what you do. In your case, based on what you have said, I suspect your at low risk.
Jun
25
comment LastPass - Best practices on foreign devices
SaaS = Software as a Service. PWMs tend to fall into 2 types, those which provide a SaaS/cloud service (LP) and those which use a locally stored vault (1Password), where vault is stored locally (dropbox, usb stick etc). Problem with SaaS model is your sensitive data is 'out there', making it a target. Consider recent LP breach where some data, including master password recovery hints, was stolen. While the password vault was not compromised, there is a risk someone could guess your master pwd from the hints - game over. If your sensitive data is not 'in the cloud', smaller attack surface.
Jun
20
comment LastPass - Best practices on foreign devices
I don't believe you can give a more definitive answer unless you have in depth access to the code used by LastPass. The advice is not to use LastPass (or any password manager) on an untrusted device. The other point is to be careful with password managers like LastPass which provide a SaaS style interface.
Jun
18
answered LastPass - Best practices on foreign devices
May
30
comment What's the risk of opening ports 1-65535?
Yes, needs clarifying. Regardless, any suggestion to open all ports from 1 - 65k is a support suggestion to be ignored. Any service which provides support answers like that is not a service you want to use.