1,446 reputation
512
bio website redhardsupra.blogspot.com
location Laurel, MD
age 37
visits member for 3 years, 9 months
seen 5 hours ago

Jun
16
answered Tools to test all-around hardness of a Unix installation?
May
23
comment encryption for short messages
No 'problem' just trying to see how I can make it better/faster/not set myself up for any crypto hackery that might be a result of not having longer messages.
May
23
asked encryption for short messages
Apr
22
comment Find out what Linux software is trying to phone home
watch is much nicer than while true; do...done
Feb
26
awarded  Good Answer
Jan
23
comment Should I decode a base64 password before hashing for storage?
I meant it for the attacker snooping on the transmission, if you see a string that looks like base64, it's trivial to extract end decode it. All that happening before he hashes things.
Jan
23
comment Should I decode a base64 password before hashing for storage?
Base64 is really easy to recognize too, the format instantly gives away what you'd want to try on it to decode it.
Jan
10
awarded  Popular Question
Dec
2
revised Taxonomy of Ciphers/MACs/Kex available in SSH?
added a link
Nov
18
awarded  Yearling
Jul
19
answered Why is unshadowing needed?
Jan
24
revised What things should a penetration tester know about databases?
more info
Jan
24
answered What things should a penetration tester know about databases?
Jan
16
comment How to crack password hashed using SSHA?
Depending on the format, you might have to convert the hash/salt to/from hex/base64 for JtR or Hashcat to work on them.
Nov
18
awarded  Yearling
Oct
26
comment Access control matrix and integrity
Biba (integrity) and Bell-La Padula (confidentiality) are 'duals' of one another, so whatever you can do with one you can do with the other.
Oct
22
comment The Creation of Secure Software Development Environments
The G in STIG stands for Guide. STIGs were originally intended as a starting point. However, since the accreditors tend to have severe tunnel vision, and hold people's feet to the fire over complete, blind compliance to the STIGs, they've become a de facto 'Law.' STIGing a box should be a mere beginning, a nice starting point to building a more secure system, not the official stopping point, with the ability of being penalized for actually improving upon it.
Oct
16
comment Enterprise IDS - Deployment & Uses
"Snort's free, sure, but your time isn't" +1 for t-shirt worthy quote ;)
Oct
9
comment security issue on storing keys and certificate on token
Even if the EEPROM is read-only, wouldn't anyone with an EEPROM reader be able to get your private key, at which moment they can pretend to be that token?
Sep
25
awarded  Nice Answer