1,095 reputation
25
bio website
location Australia
age
visits member for 2 years, 9 months
seen Jul 23 at 22:26

An IT security manager who still loves coding and problem solving. After over 20 years, still trying to master the craft of writing reliable, clear, concise and elegant code.


Jul
9
answered Web services API key
Jul
9
answered Distributed tokenization for credit card numbers
Jul
3
comment How are leaked government credentials possible and what's the point?
I don't think the password credentials was the critical issue with the OPM break. The actual data of value was all the other details, such a full name, SN, parents name and most importantly, details of the government security check. Essentially, all the key info you need for effective identity theft or to blackmail government employees etc
Jul
3
answered Can an attacker “simulate” a private IP address?
Jul
2
comment Is possible to get infected by only staying connected to the Internet (nothing else)?
There are no certainties. Even if you have applied all updates you may still be vulnerable to a zero day which the vendor does not know about or a vulnerability which has not yet been patched. All you can do is reduce the risk to a level which is acceptable. What is acceptable depends on what you do. In your case, based on what you have said, I suspect your at low risk.
Jun
25
comment LastPass - Best practices on foreign devices
SaaS = Software as a Service. PWMs tend to fall into 2 types, those which provide a SaaS/cloud service (LP) and those which use a locally stored vault (1Password), where vault is stored locally (dropbox, usb stick etc). Problem with SaaS model is your sensitive data is 'out there', making it a target. Consider recent LP breach where some data, including master password recovery hints, was stolen. While the password vault was not compromised, there is a risk someone could guess your master pwd from the hints - game over. If your sensitive data is not 'in the cloud', smaller attack surface.
Jun
20
comment LastPass - Best practices on foreign devices
I don't believe you can give a more definitive answer unless you have in depth access to the code used by LastPass. The advice is not to use LastPass (or any password manager) on an untrusted device. The other point is to be careful with password managers like LastPass which provide a SaaS style interface.
Jun
18
answered LastPass - Best practices on foreign devices
May
30
comment What's the risk of opening ports 1-65535?
Yes, needs clarifying. Regardless, any suggestion to open all ports from 1 - 65k is a support suggestion to be ignored. Any service which provides support answers like that is not a service you want to use.
May
30
comment Is this sufficient text cleaning in a PHP Form?
Good answer. I would extend and say that what sanitising you need to do also depends on what you want to allow. If it makes no sense to allow users to input HTML etc, just don't allow it.
May
30
answered Are consumer-grade routers any more or less vulnerable?
May
30
answered Why do “Forgotten Password?” links generally reveal usernames or registered email addresses?
May
30
answered How to detect self destructing emails? How to prevent from self destruction?
May
30
answered Utility to build IP exclusion list?
May
30
answered Getting the uploaded file path without knowing the uploading destination
May
30
answered Custom CSRF protection mechanism without persisting tokens
May
29
comment How can spoofing a certain MAC address enable sending probe requests that I was never connected to?
Are these APs ones which this device has been connected to in the past (with or without the spoofed MAC?). If so, I would suspect it is due to your OS, which is just looking to see if any known APs are available.
May
29
answered how we know whether our computers are part of a botnet?
May
28
answered What makes an Android application vulnerable to Cross-site scripting (XSS)?
May
28
answered Is this way of encoding cryptographic hashes safe?