693 reputation
17
bio website
location
age
visits member for 1 year, 9 months
seen 20 hours ago

Jul
11
comment What should you do when you notice weird traffic?
"My personal server gets portscanned, dirbustered, etc., multiple times a day. I don't even blink at those reports, it's just noise at this point." +1 To this statement. This sort of thing happens on a continual basis. You will put yourself into an early grave if you try to proactively investigate and block every person who scans your network.
Jul
9
comment When is it appropriate to provide clickjacking protection one of my websites pages?
Just wanted to add that not all browsers support the X-Frame option. If you're concerned with protecting users with older browsers you need to include frame busting java script on the pages you want to protect.
Jul
8
comment How did my network admin identify my iPhone and how can I hide my ID?
You need to remember that while it may be "my personal phone" it is your COMPANY'S network. You are using their bandwidth.
Jul
7
comment If an ATM is stolen, how easy can the personal information of the users be recovered?
It's called an "Encrypted Pin Pad", or EPP for short. Source: diebold.com/Diebold%20Asset%20Library/…
Jun
30
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've always liked this explanation. Much easier to grasp than a bunch of math equations.
Jun
29
comment How can clicking a link in a Facebook users news feed compromise their account
Just know this; merely clicking the wrong link can cause you to get completely owned. The internet is a very dangerous place. Zero Day exploits can exist long before the public is aware. The worst of these allow your machine to be compromised simply by clicking a malicious link. Never take candy from a suspicious looking link. Never take a ride with a suspicious looking link. Does this sound familiar? It's the same thing our parents taught us as kids. Links are strangers. Strangers are dangerous. Beware the stranger danger!
May
27
comment How Safe Are Encrypted Websites Really?
Do tell, what behavior made him look "as if he was doing something suspicious on his computer as far as hacking/networking".
May
27
comment How do I inject JavaScript into a JPG image and execute it when uploaded?
You might try this method: wikihow.com/Hide-Text-Within-an-Image You can hide the js inside the actual jpg
May
15
comment Suggestions to avoid cookie-hijacking in a web application
Setting the ;secure and ;httponly flags will also help prevent cookie highjacking.
Apr
16
comment Why do some websites need time to log you in securely, while others can do it instantly?
Spot on. Often times it's a "feel good smokescreen" which is masking the amount of time it takes to query the backend database for user authentication.
Apr
1
comment IDS in combination with vulnerability scanner
Just to clarify, there is a difference between configuring the IDS to block alerts, and whitelisting the IP so that the attacks go through. You definitely want to perform the latter. The former if the alerts become overwhelming.
Mar
7
comment Make firewall management public?
However, Web servers/applications on the other hand are notorious for merely being secure for a point in time. There's always another java/php/.net/Apache/IIS exploit right around the corner, and those are only the ones that are publicly discovered and/or divulged. If you or anyone else is comfortable with that risk, that's your/their prerogative. I'm not comfortable taking that risk for something as critical as the Firewall. :)
Mar
7
comment Make firewall management public?
A VPN provides another layer of protection that ideally would use a physical token in addition to a password for authentication. I rarely, if ever have seen vulnerabilities surface that allow an attacker to exploit a VPN platform to gain unauthorized access. Usually it's an userID/password compromise.
Feb
14
comment Why can't someone break email or https encryption by somehow getting access to the encryption key?
Thank you, that has to be one of the best explanations I've read yet. (the gift sending analogy)
Feb
5
comment SSL Handshake failed
My vote is for bullet point number one. Check to make sure the proper intermediate/root certificates exist on the clients that are failing to connect.
Dec
18
comment Does HTTPS encryption work when there is invalid or there is no certificate?
@Adnan You're taking the context or "spirit" of the OP's question out of context for the sake of being "right". The OP's question was clearly in regards to certificates. The method you are describing is not practical for a publicly facing webserver in which anonymous/random users would need access. To my knowledge, IIS does not support RFC4279.
Nov
26
comment How to secure and limit access to a web based application hosted on a local server
Is the web server running IIS? Are you on a domain?
Oct
25
comment Safe to expose Active Directory via LDAPS externally?
One thing to consider, how are you going to stop nefarious users from brute forcing LDAP passwords? How are you going to prevent accounts from being locked out remotely if a malicious user stumbles across this exposed LDAP service?
Jul
11
comment SSL with GET and POST
Just wanted to point out that if you're using GETs to pass credentials (regardless if you're using SSL) that the passwords will be stored in plain text in the Web server logs.
May
14
comment Somehow unexpectedly my computer got infected with malware
@roxyfm - I recommend Qualys Browser Check to make sure your plugins/extensions aren't leaving you vulnerable. I would also run Secunia PSI and make sure all your programs are up to date. If you really want to take it to the next level, download the community versions of RetinaCS by BeyondTrust or Nexpose by Rapid7.