743 reputation
17
bio website
location
age
visits member for 1 year, 10 months
seen 17 hours ago

Jul
9
comment When is it appropriate to provide clickjacking protection one of my websites pages?
Just wanted to add that not all browsers support the X-Frame option. If you're concerned with protecting users with older browsers you need to include frame busting java script on the pages you want to protect.
Jul
8
comment How did my network admin identify my iPhone and how can I hide my ID?
You need to remember that while it may be "my personal phone" it is your COMPANY'S network. You are using their bandwidth.
Jul
8
answered Can I use a single SSL cert on two different servers?
Jul
7
comment If an ATM is stolen, how easy can the personal information of the users be recovered?
It's called an "Encrypted Pin Pad", or EPP for short. Source: diebold.com/Diebold%20Asset%20Library/…
Jul
2
awarded  Informed
Jul
2
answered What kinds of attacks would be missed if we don't look at both host and network activity
Jun
30
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've always liked this explanation. Much easier to grasp than a bunch of math equations.
Jun
29
comment How can clicking a link in a Facebook users news feed compromise their account
Just know this; merely clicking the wrong link can cause you to get completely owned. The internet is a very dangerous place. Zero Day exploits can exist long before the public is aware. The worst of these allow your machine to be compromised simply by clicking a malicious link. Never take candy from a suspicious looking link. Never take a ride with a suspicious looking link. Does this sound familiar? It's the same thing our parents taught us as kids. Links are strangers. Strangers are dangerous. Beware the stranger danger!
Jun
20
revised How can I convince my customers not to send Credit Card data over email?
added more information.
Jun
18
answered How can I convince my customers not to send Credit Card data over email?
May
30
answered What is a good source for hardened base configurations
May
27
comment How Safe Are Encrypted Websites Really?
Do tell, what behavior made him look "as if he was doing something suspicious on his computer as far as hacking/networking".
May
27
comment How do I inject JavaScript into a JPG image and execute it when uploaded?
You might try this method: wikihow.com/Hide-Text-Within-an-Image You can hide the js inside the actual jpg
May
15
comment Suggestions to avoid cookie-hijacking in a web application
Setting the ;secure and ;httponly flags will also help prevent cookie highjacking.
Apr
16
comment Why do some websites need time to log you in securely, while others can do it instantly?
Spot on. Often times it's a "feel good smokescreen" which is masking the amount of time it takes to query the backend database for user authentication.
Apr
3
awarded  Critic
Apr
1
comment IDS in combination with vulnerability scanner
Just to clarify, there is a difference between configuring the IDS to block alerts, and whitelisting the IP so that the attacks go through. You definitely want to perform the latter. The former if the alerts become overwhelming.
Mar
25
answered Good reason to continue using fraudulent certificate?
Mar
7
comment Make firewall management public?
However, Web servers/applications on the other hand are notorious for merely being secure for a point in time. There's always another java/php/.net/Apache/IIS exploit right around the corner, and those are only the ones that are publicly discovered and/or divulged. If you or anyone else is comfortable with that risk, that's your/their prerogative. I'm not comfortable taking that risk for something as critical as the Firewall. :)
Mar
7
comment Make firewall management public?
A VPN provides another layer of protection that ideally would use a physical token in addition to a password for authentication. I rarely, if ever have seen vulnerabilities surface that allow an attacker to exploit a VPN platform to gain unauthorized access. Usually it's an userID/password compromise.