141 reputation
5
bio website sammitch.ca
location Canada
age
visits member for 2 years, 1 month
seen Dec 10 at 21:00

Professional IT Squirrel Herder and advocate of hitting problems with sticks.


Sep
24
awarded  Autobiographer
Sep
24
comment iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?
@LateralFractal they get to pack a few more buzzwords into their marketing material.
Sep
10
comment How to effectivily block torrents on my network?
This is primarily a layer 8 issue.
Sep
10
comment How to effectivily block torrents on my network?
Also bear in mind that some people use bittorrent for legitimate business purposes like downloading linux distros and other large bricks of software.
Sep
10
comment Does it make sense to choose a longer password than the output of a hash?
+1 simply for "slightly dented"
Feb
20
awarded  Commentator
Feb
20
awarded  Critic
Feb
20
comment IP forgery (theories are fine)
You can certainly send a packet with a forged source IP, but you're not likely to be able to receive the response.
Jan
3
comment How to track down an IP spoofer?
Did the MAC address change, or did it not get blocked correctly?
Jan
2
comment How to track down an IP spoofer?
Try blocking that MAC address and see if anyone complains. Either way, problem solved.
Dec
13
comment Gold Standard for password hashing
IMHO if a PBKDF2 implementation won't let you control a critical component like the hashing function, then it's probably not worth using. The fact that it uses SHA1 makes it worthless.
Nov
28
comment Safe to make a VPN connection over coffee shop WIFI?
In the context of this answer it's also prudent to note that if you are using a 3rd-party VPN service, either 'free' or paid, you should be aware that: 1. You data is no longer 'protected' between the endpoint of the VPN provider and the target service you're attempting to access. 2. Your VPN provider itself can very easily eavesdrop on your traffic.
Nov
28
comment HTTPS or HTTPS within VPN for WIFI security?
@JonathanGarber All an attacker needs to do is spend 5 minutes looking through a list of compromised websites to find one with a valid SSL cert, post his JS there, and then include that into whatever page and it won't trigger a warning unless you've got something like NoScript. Trust me, I worked for a hosting company a looong time and saw many a moron with VPASP carts that hadn't been updated for 5 years, but god help you if their $10 SSL cert expires because they're yelling at you on the phone within the hour.
Nov
22
awarded  Supporter
Nov
22
answered HTTPS or HTTPS within VPN for WIFI security?
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
@EranMedan you'd still be shocked how bad it is. Fun fact: Plesk Panel for Windows still stored all passwords as plain text as of the current version last I looked at it about 4 months ago. Basic hashing was supposed to be implemented as an option "in the next version" but I have my doubts.
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
@EranMedan it's less bad, but it's still best to not use it at all. SHA-1 effectively has a "shortcut" that allows an attacker to reverse a hash [or generate hash collisions, I don't remember exactly] relatively easily, and generally faster than a regular bruteforce.
Nov
21
comment Is it possible to prevent user from dumping hashes?
Also, if you do not use drive encryption or a password-protected BIOS that excludes CD/USB boot then the user can simply pop in a boot disk and grab the hashes thusly.
Nov
21
awarded  Teacher
Nov
21
answered Is there a table that compares hashing algorithms by speed, relatively (machine independent)