Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
14
Impact
~21k people reached

Apr
23
comment Can a computer virus be stored somewhere else than on the hard drive?
If you want to be scared or impressed depending on your position check out hardware manufacturers reference documentation. For example Dell offers a document called "Statement of Volatility" for all servere. It contains mjltiple pages with inventory of (writeable, flash) firmware storage in a enterprise server. Sample: downloads.dell.com/manuals/common/…
Apr
19
comment UAC and Windows Services
I am also looking for a way to run a service as elevated user. I dont want to use the unrestricted local sytem. It would be a security feature not a bug if it was supported.
Mar
29
comment How do I verify a GPG signature attached for a cleartext email using the gpg command line?
BTW: with mutt those hierachies are visible and you can save the parts seperately.
Mar
22
comment gpg 2.0 command line option to create UTF-8 data
It looks like not only the textmode, but especially the UTF8 textmode seem to not be used. I will stick with binary content for my usecase (as I am on both sides).
Mar
13
comment Critical sub-packets in OpenPGP not used
I am specifically wondering about setting the expire to critical. But I guess I should better not care.
Feb
9
comment How do NFC tags prevent copying?
The question is if the symmetric key can be read by unauthenticated readers. If not it is at least protecting against cloning by reading (but not cloning by the admin).
Jan
14
comment Why refresh CSRF token per form request?
Constant time compares can and should be used to mitigate this (loop over all chars and xor a difference flag).
May
8
comment Why clients offer handshaking with SSL 2.0 protocol
Actually there are Clients who sent modern packets, and if they do not get proper responses re-try with a more conservative approach (like for example SSL2 record format). This Out Of Band Protocol Fallback is one of the problems in Poodle. Newer Clients are supposed to send a TLS_FALLBACK_SCSV {0x56, 0x00} virtual ciper in that case (so a server can reject those weakend attempts if he thinks he is up-to-date).
Apr
9
comment LDAP Authentication and Sessions
Ah re "AD problem" yes right, its a general LDAP question (but if only AD has a solution for the problem I would be interested in it as well as it is a large customer base).
Apr
9
comment LDAP Authentication and Sessions
Hm, the directory servers I have worked with all check for locked, expired or restricted accounts on bind (at least for the usual conditions). This is exactly why it is usefull, I do not have to know all the different policies a company might have (based on unknown OIDs). (and the question was not about rapid kicking, its more about "within days" for remember-me type of scenarios. (and I am just mildly concerned about storing credentials just like everybody should).
Apr
7
comment LDAP Authentication and Sessions
yes I can check it with fast bind, thats why I like to use it. But I do need to have the password for that. (I have the password at the initial login, but I also need it for re-validation of existing sessions or of rembered sessions, and today I do not have the password handy at those times)
Apr
7
comment LDAP Authentication and Sessions
Hopefully the users use LDAPS if they dont trust the backend network.
Apr
7
comment LDAP Authentication and Sessions
Actually for DB it works quite fine since I normally use a system DB user so I can check every few minutes if the user is not locked or has changed meta data. With LDAP i can do that only when I have a system user, but then I cant use the LDAP server policy enforcing which I get from simple binds.
Apr
7
comment LDAP Authentication and Sessions
Yes, but this does not help me, since I can set a lifetime for a http session as well. In both cases I would need the credentials (password) to re-requerst authentication.
Apr
4
comment Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms?
Besides the good answers, I just want to point out, that the problem of combining multiple streams is unfortunately less common than the problem of mixing in untrusted sources into a state pool.
Apr
4
comment LDAP Authentication and Sessions
BTW: not sure how does the Web Browser SSO profile of SAML solve the session problem?
Apr
4
comment LDAP Authentication and Sessions
Yes, we also might use SAML, but this problem here is specific to using LDAP with simple bind as an authentication provider.
Mar
20
comment 1024-bit DHE vs 2048-bit RSA
It is fixed in Java 8 (docs.oracle.com/javase/8/docs/technotes/guides/security/… and docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/…)
Feb
4
comment Is it safe to include timestamps in error codes that are shown to the users?
You could return a short "request ID" instead. If you really have a user who wants to be nice and contact support about the error, thay can report that XID. (You could even add a "sent mail" link which includes it. Having said that, the Date: header with second resolution should be fine.
Feb
4
comment What is the ideal HMAC message format if message is an array?
actually in order to ensure order you need to sort it by key with a fixed comparator. And remeber to also specify the encoding. Personally I would concatenate zero terminated UTF8 bytes (if \0 cannot occur in data).