871 reputation
25
bio website
location Australia
age
visits member for 2 years, 5 months
seen Mar 28 at 2:34

An IT security manager who still loves coding and problem solving. After over 20 years, still trying to master the craft of writing reliable, clear, concise and elegant code.


Mar
26
answered How can a very small company handle PCI-DSS requirement 6.4.2?
Mar
26
answered What is the key when the client want to get a session id in SSL
Mar
26
answered Hide the fact of e-mail communication
Mar
19
answered Historical events in terms of risk assessment
Mar
19
answered Evading IDS in exploit development
Mar
19
answered Can an old operating system webserver be made secure?
Mar
12
answered Is sending passwords through cellphone text messages secure?
Mar
12
answered Is it legal to start a private website for you and your friends to hack?
Mar
5
answered “Secure” third-party inbox
Mar
5
answered Possibility to sniff HTTPS traffic on devices without installing a certificate
Feb
22
comment Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN
What is most important is to match the product with your requirements. To do this, you need to look at what your risk profile is (i.e. likelihood of someone trying to do something bad and consequence should they do it). Then find the product within your resource limits which will provide the right balance. There is no absolutes here and you will never have 100% protection. It is also estimated that 70% of security holes are caused by misconfiguration. Often it is better to have less sophisticated and correct than very sophisticated and wrong
Feb
22
answered Issues with using TLS Session Id for Web App Session?
Feb
22
answered Why does a nmap scan give different results depending on whether it's run from inside or outside a LAN
Feb
13
comment Session Hijacking through sessionId brute-forcing possible?
Yes, the random token used as an anti-forgery protection is a good example. The point to note is that you don't just rely on the session cookie. You can use other information available in the headers and form fields as well as doing things like limiting the lifetime of the session cookie.
Feb
13
comment Login account check
No, this is rarely the way it is done. Normally, if you are going to do this check, you also want to check that the person using that email is the owner, iin which case, you would normally send a confirmation email tot he address with a link. The user must confirm using that link before the account is activated
Feb
13
answered How to secure a network (FTP connections) from sniffers
Feb
13
answered Mechanism used for offline authentication of software
Feb
13
answered vulnerability scan process management.
Feb
12
answered What is a good way to authenticate a user to a smart phone?
Feb
5
answered Can sms-only authentication be safe?