487 reputation
25
bio website
location Australia
age
visits member for 2 years, 2 months
seen Dec 12 at 20:24

An IT security manager who still loves coding and problem solving. After over 20 years, still trying to master the craft of writing reliable, clear, concise and elegant code.


Dec
11
answered Redeploying multiple Secure sites on a single server
Dec
11
comment Is Adblock (Plus) a security risk?
There have already been cases where developers of chrome extensions have sold their IP to another party who has not had the same ethics, security precautions etc. This is not to say AdBlock is a risk. It just emphasises that when you use an extension, you need to recognise that the situation can change and something you trusted and were confident about may end up evolving into something less trustworthy.
Dec
11
answered Would 'spam' mail really avoid eavesdropping?
Dec
11
comment Would 'spam' mail really avoid eavesdropping?
The blanket statement "security through obscurity is bad" is incorrect and a misrepresentation of what is intended. Security through obscurity is only bad when this is the only security control used. Provided obscurity is used in conjunction with other controls, it is not only legitimate, but extremely useful. Just don't rely on it as your only level of protection.
Dec
11
answered Since I can set the source IP address to anything using raw sockets, does this mean I am untraceable?
Oct
11
awarded  Yearling
Sep
24
awarded  Autobiographer
Nov
21
answered Managing and deploying web app passwords
Nov
21
comment How secure is NOPASSWD in passwordless sudo mode?
One other aspect to consider with respect to using NOPASSWORD is that it removes one very useful control. If access requires a password, you can centrally restrict access to everyone/everything by changing the password. This is not as useful if scripts all sudo to root. However, with good partitioning of authorisation into different accounts, can be quite useful.
Nov
14
answered What is a good way to be alerted of major security patches for software I use?
Nov
14
answered Cryptography that looks like ordinary email
Oct
11
awarded  Yearling
Sep
20
answered How To Track Down Who Initiated A Remote File Transfer Via TeamViewer If I Have Log File
Sep
7
comment Does a maximum length of password mean non-hashed storage?
A frequent reason to see this in some business/enertprise systems is because, if the organisation wants unified passwords across systems, they have to cater for the smallest common denominator. In this situation, you cannot imply a lot regarding how the password is stored or what limitaitons may exist.
Aug
2
answered Why did my provider reset my password after someone else attempted to gain access to my account?
Jul
18
comment Should a site have SSL if it doesn't have a login form?
Forget about the email stuff. SSL/TLS does NOT improve email security by any significant amount. What it does is provide some protection for your username/password with accessing imap/smtp server. Most email servers DO NOT used encryption between servers and you have no control or knowledge of what servers an email message passes through in its route from one server to another. Email is essentially insecure unless you manually encrypt the data yourself and use something like PKI
Jul
18
comment Should a site have SSL if it doesn't have a login form?
This answer shows confusion regarding secure email (which is an oxymoron anyway)
Jul
18
comment Should a site have SSL if it doesn't have a login form?
Also agree. These days, there are few legitimate reasons not to just use SSL. In my experience, security flaws are often found in sites with mixed SSL and non-SSL configurations because of either a config error or soemething being accessible from the non-SSL site by mistake. When SSL represented significant processing overhead, it was worthwhile having content split between SSL and non-SSL. However, this is less justified and given you already havve sensitive info (job apps), SSL would make sense.
Jul
18
answered Most secure way to partition linux?
May
29
answered How to avoid scripts with hardcoded password?