999 reputation
317
bio website markhaase.com
location Washington, DC
age 32
visits member for 3 years, 9 months
seen 12 hours ago

Dec
4
comment Preventing Illegal Access to Webservice
"Another idea was to restrict access by MAC address." This only works for devices that are on the same subnet as your server, because MAC addresses are layer 2 and IP routing is layer 3.
Aug
21
comment Open exploits database, with structured data (CMS name, version, etc.)
You're confusing the term "exploit" with "vulnerability". A vulnerability is a flaw in a program, while an exploit is a demonstrated use of that flaw. (Also, I'd be remiss if I didn't plug my own SCAP solution which has a better API than the NVD: scapsync.com)
Jul
31
comment Feeding /dev/random entropy pool?
I just faced this problem while trying to generate GPG keys on a virtual server. I found that downloading a large ISO (say a linux distribution DVD) adds entropy pretty quickly.
Jul
17
awarded  Popular Question
Jul
7
comment Does cross platform (authenticated) volume encryption exist?
@Mark Good point. I'm thinking of an encrypted disk image, not necessarily a physical drive.
Jul
6
asked Does cross platform (authenticated) volume encryption exist?
Jul
2
awarded  Curious
May
5
revised How to get public key of a secure webpage?
Select better tags.
May
5
suggested approved edit on How to get public key of a secure webpage?
Mar
17
comment How to get an “A” on Qualys SSL Labs with Apache 2.2?
Thank you. I'm using 2.2.22-1 (on Ubuntu 12.04), so it looks like I'm stuck until I upgrade Apache.
Mar
17
accepted How to get an “A” on Qualys SSL Labs with Apache 2.2?
Mar
17
asked How to get an “A” on Qualys SSL Labs with Apache 2.2?
Mar
9
awarded  Nice Answer
Mar
6
comment Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?
Lots of interesting questions. I think you give them too much credit. Keep in mind it's still a top-down bureaucracy led by aged men who don't know diddly about cutting edge technology. The military uses Sharepoint, Exchange, and WSUS, just like everybody else. My guess is that the separations between classification levels aren't nearly as sophisticated as our imaginations want them to be. (Although that may have begun to [slowly] change since Manning/Snowden.)
Mar
6
comment Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?
I've never used either one, but from talking to people who would know, I believe this is the correct answer. The networks are physically separated within a facility to discourage copying between them, meaning you might have 2 or 3 computers on your desk (internet, NIPR, and SIPR). This picture captures it well: en.wikipedia.org/wiki/File:Intel_GreenDoor.jpg. Outside of the facility, traffic is encrypted and transferred over the public internet – basically, just fancy names for a VPN.
Feb
28
revised What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?
Original version typed on my phone. Cleaned up here.
Feb
27
awarded  Yearling
Feb
27
answered What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?
Feb
6
awarded  Popular Question
Jan
10
comment Are USB thumb drives inherently more dangerous than other removable media? Why?
Nothing you're saying is incorrect, but it also applies to DVDs: DVDs are ubiquitous, not super-technical, are very cheap, and could easily be used for exfiltration. (Easy to hide in a pocket or briefcase, and unlikely to set off any metal detector.)