meta user
network profile
| bio | website | |
|---|---|---|
| location | Scotland | |
| age | ||
| visits | member for | 6 months |
| seen | May 17 at 15:59 | |
| stats | profile views | 28 |
I'm a contract Security Architect based in Scotland, UK. I derive strategy for large organisations as well as provide design mentoring and governance.
|
May 15 |
comment |
Unsolicited Password Request from Facebook interestingly, my wife got one of these for the first time on her Android yesterday. The message also included the name and location "Howard from Houston" and asked her "do you know this person?" to which she said no and then she was forced to change her password in the Android app (did not ask for old passwd). The problem is that the user has no cue as to whether it is real or not. |
|
Mar 7 |
comment |
How do I get my Encryption Certificate back? do you know if the user backed up the certificates? |
|
Mar 7 |
comment |
CSRF mitigation in MVC if the app was totally stateless then I don't think a CSRF would be possible. So... there must be a session state being recorded somewhere. If it's a java-based app then you'd naturally use the HttpSession. |
|
Mar 7 |
answered | Reading for starter in Computer System Security |
|
Feb 11 |
answered | what is the use of stolen personal details? |
|
Feb 6 |
answered | When should I use the word hacker, cracker, or black hat? |
|
Feb 4 |
answered | Securing the SOAP Messages |
|
Feb 4 |
comment |
Are you aware of any CEO that went to jail because of Security Flaws? I was more referring to the actions taken by staff during the investigation rather than the phone hacking itself. When staff realised they were being prosecuted they went on the rampage deleting evidence... not a perfect example but it's the closest I can think of. |
|
Feb 1 |
answered | Are you aware of any CEO that went to jail because of Security Flaws? |
|
Jan 30 |
comment |
How does processor architecture affect password hashing speed? @Steel - quite right, the CPU and GPU are on the same Broadcom BCM2835 chip. it isn't just a GPU |
|
Jan 30 |
comment |
Are banks required to be PCI compliant? It's a mixture. There are legal, contractual, regulatory and ethical standards to apply. Clearly the bank owns it's own appetite to risk and therefore can have it's own take on these standards. There is a balance between cost, security and functionality that each bank has to make a decision on before investing in an effective control framework. In my experience, it's rare for a bank not to take security standards seriously. |
|
Jan 30 |
answered | how Cookie tracking threat works? |
|
Jan 30 |
comment |
How does processor architecture affect password hashing speed? the Raspberry PI only has a GPU! |
|
Jan 30 |
answered | Are banks required to be PCI compliant? |
|
Jan 30 |
answered | What vulnerabilities in the OWASP Top 10 are relevant to WordPress? |
|
Jan 29 |
answered | Reverse engineering and Java |
|
Jan 29 |
comment |
How secure is the new Mega-site encryption? Mega themselves recognise the "lost passwd = lost data" issue and are coming up with a system to allow users to recover data using a key export feature. Check out: gizmodo.com/5978164/… |
|
Jan 28 |
comment |
Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it? it may be legal in Europe, but your EULA that was expressly agreed does not allow it in 2.2.6. Just pointing it out to the community because it could cause some in-house lawyers to have minor heart feailure. |
|
Jan 28 |
comment |
How to treat non-optional bad security questions? One site I went to used the same "security questions" online as on the phone. which made for a strange conversation when I had to explain that my mothers maiden name was a mixture of numbers, non-alphanumeric characters and letters. (this is an example of bad practice btw. never use full security questions on phone and online) |
|
Jan 28 |
answered | Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it? |
