583 reputation
16
bio website blog.k1DBLITZ.com
location
age
visits member for 1 year, 5 months
seen Apr 17 at 18:00

Apr
16
comment Why do some websites need time to log you in securely, while others can do it instantly?
Spot on. Often times it's a "feel good smokescreen" which is masking the amount of time it takes to query the backend database for user authentication.
Apr
3
awarded  Critic
Apr
1
comment IDS in combination with vulnerability scanner
Just to clarify, there is a difference between configuring the IDS to block alerts, and whitelisting the IP so that the attacks go through. You definitely want to perform the latter. The former if the alerts become overwhelming.
Mar
25
answered Good reason to continue using fraudulent certificate?
Mar
7
comment Make firewall management public?
However, Web servers/applications on the other hand are notorious for merely being secure for a point in time. There's always another java/php/.net/Apache/IIS exploit right around the corner, and those are only the ones that are publicly discovered and/or divulged. If you or anyone else is comfortable with that risk, that's your/their prerogative. I'm not comfortable taking that risk for something as critical as the Firewall. :)
Mar
7
comment Make firewall management public?
A VPN provides another layer of protection that ideally would use a physical token in addition to a password for authentication. I rarely, if ever have seen vulnerabilities surface that allow an attacker to exploit a VPN platform to gain unauthorized access. Usually it's an userID/password compromise.
Feb
18
answered VPN Client - Addtional Security Layer or a Useless Feature
Feb
14
answered Make firewall management public?
Feb
14
comment Why can't someone break email or https encryption by somehow getting access to the encryption key?
Thank you, that has to be one of the best explanations I've read yet. (the gift sending analogy)
Feb
14
answered what will happen if us government shutdown Tier-1 internet backbone?
Feb
5
comment SSL Handshake failed
My vote is for bullet point number one. Check to make sure the proper intermediate/root certificates exist on the clients that are failing to connect.
Jan
15
answered Contents retrieved from a not protected url from content owner's server. Legal?
Jan
2
answered Are USB thumb drives inherently more dangerous than other removable media? Why?
Dec
18
comment Does HTTPS encryption work when there is invalid or there is no certificate?
@Adnan You're taking the context or "spirit" of the OP's question out of context for the sake of being "right". The OP's question was clearly in regards to certificates. The method you are describing is not practical for a publicly facing webserver in which anonymous/random users would need access. To my knowledge, IIS does not support RFC4279.
Dec
4
revised Organizing scheduled vulnerability scans
spelling error
Dec
4
suggested suggested edit on Organizing scheduled vulnerability scans
Nov
26
comment How to secure and limit access to a web based application hosted on a local server
Is the web server running IIS? Are you on a domain?
Nov
1
awarded  Yearling
Oct
28
revised Is SSL required for sites hosted behind WAF?
added 10 characters in body
Oct
28
answered Is SSL required for sites hosted behind WAF?