932 reputation
315
bio website
location Washington, DC
age 31
visits member for 3 years, 1 month
seen yesterday

Mar
17
comment How to get an “A” on Qualys SSL Labs with Apache 2.2?
Thank you. I'm using 2.2.22-1 (on Ubuntu 12.04), so it looks like I'm stuck until I upgrade Apache.
Mar
17
accepted How to get an “A” on Qualys SSL Labs with Apache 2.2?
Mar
17
asked How to get an “A” on Qualys SSL Labs with Apache 2.2?
Mar
9
awarded  Nice Answer
Mar
6
comment Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?
Lots of interesting questions. I think you give them too much credit. Keep in mind it's still a top-down bureaucracy led by aged men who don't know diddly about cutting edge technology. The military uses Sharepoint, Exchange, and WSUS, just like everybody else. My guess is that the separations between classification levels aren't nearly as sophisticated as our imaginations want them to be. (Although that may have begun to [slowly] change since Manning/Snowden.)
Mar
6
comment Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?
I've never used either one, but from talking to people who would know, I believe this is the correct answer. The networks are physically separated within a facility to discourage copying between them, meaning you might have 2 or 3 computers on your desk (internet, NIPR, and SIPR). This picture captures it well: en.wikipedia.org/wiki/File:Intel_GreenDoor.jpg. Outside of the facility, traffic is encrypted and transferred over the public internet – basically, just fancy names for a VPN.
Feb
28
revised What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?
Original version typed on my phone. Cleaned up here.
Feb
27
awarded  Yearling
Feb
27
answered What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?
Feb
6
awarded  Popular Question
Jan
10
comment Are USB thumb drives inherently more dangerous than other removable media? Why?
Nothing you're saying is incorrect, but it also applies to DVDs: DVDs are ubiquitous, not super-technical, are very cheap, and could easily be used for exfiltration. (Easy to hide in a pocket or briefcase, and unlikely to set off any metal detector.)
Jan
10
accepted Are USB thumb drives inherently more dangerous than other removable media? Why?
Jan
7
comment Penetration testing reported ZERO vulnerabilities. Does this mean my web app is secure?
The only secure computer is one that's unplugged, locked in a safe, and buried in a concrete block 100 feet below ground. And even then it's not perfectly secure. NOTHING is perfectly secure.
Jan
2
asked Are USB thumb drives inherently more dangerous than other removable media? Why?
Dec
31
comment NX bit: does it protect the stack?
There are 2 really good answers already, so here's the TLDR: NX is a generic flag that can be applied to any memory page, stack or otherwise. Whether it's actually enabled is up to the OS, and possibly the application.
Dec
6
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
@Rook I'm not sure what you're replying to. Nowhere did I ever imply that secret keys can be kept secret; in fact, the last sentence says the opposite: "the underlying problem of trusting a device that's not under your control is not generally solved." However, various levels of obfuscation can make key recovery more difficult. Security is a continuum. The goal is to make the effort of breaking it greater than the reward, or to at least reduce the risk down to an acceptable level.
Dec
5
answered Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
Nov
14
comment I just discovered major security flaws in my web store?
Furthermore, any system where the client tells the server how much it wants to pay is flawed by design. The client should tell the server what items it wants and in what quantities. The server should calculate the amount to charge the user and should send that information directly to the payment processor, not back to the user.
Nov
14
comment I just discovered major security flaws in my web store?
There seems to be some confusion about how SSL/TLS would factor into this. TLS only prevents tampering by a man-in-the-middle (and then only when properly configured and used), but it does not prevent tampering by the end user. The end user can easily modify their own SSL traffic by using something like Tamper Data or an SSL proxy (like mitmproxy).
Oct
28
awarded  Citizen Patrol