1,461 reputation
412
bio website
location
age
visits member for 1 year, 10 months
seen 20 mins ago

Hi!

If you're in the Pittsburgh area and are interested in security I run a user group called Steel City Hackers. Feel free to check it out @ http://www.meetup.com/Steel-City-Hackers/

Jon


1d
revised Are python's popen (and similar) functions affected by Shellshock?
added 13 characters in body
1d
comment Are python's popen (and similar) functions affected by Shellshock?
True, I updated it to be a little more clear.
1d
revised Are python's popen (and similar) functions affected by Shellshock?
added 37 characters in body
1d
revised Are python's popen (and similar) functions affected by Shellshock?
added 78 characters in body
1d
answered Are python's popen (and similar) functions affected by Shellshock?
Sep
24
awarded  Autobiographer
Sep
19
comment How common is port-knocking?
I've never seen it used in an enterprise. However, I have seen firewall which lay dormant and can be enabled after telnet authentication (on page 463 of this).
Sep
17
awarded  Good Answer
Jun
19
comment Are Extended Validation certificates any more secure than regular ones?
EV certificates also check revocation more thoroughly (news.netcraft.com/archives/2013/04/16/…), although that may not entirely be a strong security mechanism (imperialviolet.org/2014/04/19/revchecking.html).
Jun
5
comment Does CVE-2014-0195 affect HTTPS?
DTLS - so things like LDAP, SNMP, WebRTS, VOIP, DTLS VPN, etc.
Apr
28
asked Transparency Report Standards
Apr
28
comment Where are MAC used?
Also, it is used in good web apps to store your session cookie.
Apr
15
comment Check logs for Heartbleed exploit use?
Why is there an assumption that TLS encryption == TCP? DTLS is essentially why we have heartbeats to begin with.
Apr
15
comment Heartbleed detection
@Lekensteyn, that question specifically refers to server logs, whereas mine addresses network traffic. Even the accepted answer, which addresses network traffic, does not address post-encryption network traffic.
Apr
14
comment Heartbleed detection
Edited the wording to be more clear that I was saying that the RFC suggests encrypted heartbeat requests, not encrypted heartbleed exploits.
Apr
14
revised Heartbleed detection
added 39 characters in body
Apr
13
asked Heartbleed detection
Apr
11
comment How can an attacker use a leaked private key?
"Decrypt any past and future traffic" assumes the same private key, and no use of PFS.
Mar
10
answered Hash Security of Windows 7 Password
Mar
5
comment 802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)
My understanding is clients use WPA/WPA2 to perform authentication and association on 802.11 networks (802.11i). For more details see my.safaribooksonline.com/book/networking/wireless/0596001835/… and my.safaribooksonline.com/book/networking/wireless/1587051540/…