Lex

1,140 reputation

1313

bio	website
	location	United Kingdom
	age
visits	member for	4 months
	seen	5 hours ago
stats	profile views	37

I am not good at anything, just better than I was before.

	1,140 reputation	bio	website		visits	member for	4 months
1313 badges		location	United Kingdom		seen	5 hours ago

summary answers questions tags badges favorites bounties reputation activity

41 Comments

suggestions reviews revisions comments badges posts accepts all

May 16	comment	Touch Screen Password Guessing by Fingerprint Trace True. Good point; I can see how this could escalate into a never ending story. +1. Thanks for that.
May 16	comment	Touch Screen Password Guessing by Fingerprint Trace Beautiful. Thank you. +1.
May 16	comment	Touch Screen Password Guessing by Fingerprint Trace @HSN. Good point, specially because it becomes more difficult to trace where the pattern starts from. Though I am not sure how much this would actually deter someone from guessing as there is no such a thing as account lockout for multiple failed attempts.
Apr 25	comment	How safe is Tor from MITM/snooping attacks? +1 for the DefCon link. Hadn't watched it before.
Apr 20	comment	Why block outgoing network traffic with a firewall? @dadinck, but if the Admin account is compromised, would it not be possible for the attacker/virus/Trojan to change the Windows Firewall settings to allow the connection to the Command&Control?
Apr 17	comment	Authentication concept for sites served to another site Beautiful problem. In the third case scenario where the e-mail is sent via the URL: Are you using HTTPS? The problem with parameters (such as the e-mail address) being sent on the URL string via GET is that URLs usually get logged in several different places like logs, bookmarks and proxies. Is it not possible to send them over the body of a POST method?
Apr 17	comment	How can i deal with management who want 'Domain Admin' access? Good point from DodgyG below: "Is it within my remit to be worried by this". I would also ask myself: "Am I covered should the worst happen?". If the answer to the first question is 'yes', and for the second question is 'no', then you should definitely try and stop that. So, in view of self-preservation having a higher priority in my list, I would definitely base my decision upon the second question, but bearing in mind the first one too. As for the list, I think you can get some general ones off internet and drill down onto your own context/environment.
Apr 15	comment	Advanced techniques for detecting a proxy/getting original IP Forgive me for the naivety: I am not trying to challenge your answer, but in order to send your geo-location, would Firefox not require explicit authorization from the user?
Apr 15	comment	Security Assessment vs. Risk Analysis great point on the 'reproducible'. +1
Apr 15	comment	how can you inject malicious code into an innocent-looking URL? Example was very useful indeed. +1
Mar 7	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field @ray023 Can't tell you that, I am afraid. However this also happens to people doing their mistakes on their windows logon too.
Mar 7	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field true, however what about people logging into their Windows Domain from a laptop? We collect these logs too.
Mar 7	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field +1 for posing the question to me as to whether we really need to know the username or not. I tend to think that we still need to username in the logs, but could be convinced otherwise should the arguments be strong enough. One of the reasons is to use correlation engine to put together time, frequency, source and destination IPs with the username. As I said, still don't have a very conclusive opinion about it, but thanks for the thought: it put me to think even more about it.@KevinReid
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field at First sight this looks pretty elegant. Thank you @MattBorja
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field Excellent suggestion. I think the majority of answers here so far put a good summary and it all makes a lot sense. +1
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field Indeed. If we try and combine this with some basic level filter as suggested by @CodesInChaos. +1
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field @CodesInChaos that's an interesting idea and I am sure it is possible to implement a regex filter for this.
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field @asadz I agree with you 100%
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field @asadz the threat seems pretty big to me, since the password might be transmitted in clear text from the username filed as if it were the username. The likelihood might be minimal, however the likelihood of internal fraud from someone abusing the log viewing privileges of the clear-text stored password that scares me the most.
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field Indeed. that would solve half of my problems/concerns. +1. Thanks very much.