2,044 reputation
3821
bio website
location United Kingdom
age
visits member for 1 year, 6 months
seen yesterday

May
22
comment Syllabus for self-studying information security and Pentesting
@Mars - you are welcome. You might need some certifications to get your foot at the door; it will usually be a Junior level entry, which is a pretty crap pay. Your proposed time-scales above might be realistic, but only if you are gifted or austere: it will take a few years until you start becoming confident on your skills. Also, if you are not into travelling too much, the life of a pentester can be pretty chaotic: bad hotel food, not much rest and pressure from clients. Pentesters with lots of experience usually manage to work solely from home or under the conditions they choose, though.
Apr
16
comment How can I verify if a website revoked its old SSL certificate keys?
I saw myself listening to the same Security Now! podcast scratching my head thinking the same thing. +1 for pre-empting my doubts, subject relevance, research and formatting of the question. Also would like to know the reasons behind downvoting...
Mar
24
comment Can I use elliptic curve DSA in a secure message service?
+1 for the simple breakdown, summary and contrast.
Mar
19
comment Should generating gpg keys ever result in an identical key to an older key?
@user12588 - have you tried using your new private as the old private key? In other words, can you use the new private key with your old public key? Have you done a 'diff' on the new and old public keys to make sure they are really the same?
Dec
30
comment Setting up a Secure Home Proxy for VPN Service Providers
thanks for your answer. Yes, they seem reasonable solutions. I kinda like the idea of the two NICs to start with; my concern is bridging the NICs, do you think this would impose any security concerns?
Dec
30
comment Setting up a Secure Home Proxy for VPN Service Providers
@GosBilgon - (apologies for delay: holidays). Well, it could be any other, but I had thought of ProXPN initially, just as a try and error. My security concern is about bridging the traffic from one NIC to another.
Dec
6
comment Rainbow Tables: What is the Reduction Used for?
+1 for the explanation on the rainbow colours. I found it very easy to understand your answer: the reason why I am selecting this answer is because of what you said: "Then, another candidate plaintext password is pulled out of that hash, and so on, creating a long chain". This reads to me as if the main reason for choosing the six number is because if you are trying to guess a six-character numeric-only password, the reduction offers a quick candidate at hand. Thanks so much.
Dec
6
comment Rainbow Tables: What is the Reduction Used for?
@Stephane - thanks so much, it has helped filling in the gaps.
Dec
5
comment Why is my Mac trying to connect to an http://akamai.com server
@JamesAndino - I would say that for a confident and reliable report on that, you could either have a box acting as a SIEM (Security Information Event Management) system such as Splunk or AlienVault on your network. If you don't want to install it and go through this hassle, you can enable logging on your perimeter router/firewall if you have blocked the IP from coming into your network.
Dec
4
comment Why is my Mac trying to connect to an http://akamai.com server
@danielAzuelos - Thanks so much for your feedback: I am not very Mac-literate. If the traffic is not so huge, your approach of using Mac's own features might do. The advantage of blocking at the perimeter level if the traffic is too high, is that by doing that, you don't waste the computer's resources.
Dec
3
comment How is DDoS different from DRDoS?
@Ebenezar - Just to be a bit more pedantic, I would add to your phrase "DDOS is is making the server unavailable or denying the service to the users for a particular time [with requests coming from multiple sources, as opposed to a DoS, which usually means one source of attack]."
Dec
3
comment Token based authentication under http
any specific reason as to why not use SSL throughout the whole application? That would the best 'best-practice' in this scenario. Also make sure the cookie has the HttpOnly flag set and if you do go for SSL across the whole application, make sure you also use the 'secure' flag.
Nov
26
comment Pentesting Cleanup
@tuson You are welcome. I guess that's when social skills supersede technical skills; the deal is to make it look like you are there to help them avoid the worst in future. When people that have years experience in service delivery, and someone with less experience in that particular subject, but well versed in security comes along, that does tend to cause make their ego very sensitive. Just be friendly and reassure them of those main things: 1) explain why it is important to know if the file was theirs or a genuine breach; and 2) make them feel that you are not there to jeopardize their jobs.
Nov
26
comment Pentesting Cleanup
@tuson - That makes sense. So the big question seems to be whether you have had a breach or the file was placed by the testers. No doubt for me, I would firstly speak with the testers and get this straight. If they say they definitely did not put/use/see the file, then the company will most certainly have to raise a security incident on a need-to-know basis.
Nov
25
comment Security risks if a server in not supported anymore
@OptimusPrime That is a risk-based decision which depends on factors that only you can tell, such as budget, time, hassle and risk, which is very valid to a business. Just make sure your scanning software is updated regularly.
Nov
22
comment Password Hashing add salt + pepper or is salt enough?
Good that Rook pointed out the flaw in Thomas' comment (thanks @Rook); still, I have upvoted the answer because the general idea makes sense, and that's what matters: I agree that complexity is security's enemy.
Nov
19
comment Strange Virus Infecting My Server
@Lucas Kauffman - any chance you could provide some pointers (papers) to this kind of malware, please?
Nov
15
comment Nmap reporting almost every port as open
@SonnyOrdell - First thing, perhaps would be a telnet against any one of such ports.
Nov
15
comment Key Management: storing encrypted key in database and decrypted key in session variable
I can't comment on the actual question, but one point deserves attention. You said: "There is no perceived threat from determined hackers as the data would have little value". This is not always true. If your server is located at a strategic position, compromising your server might be the easiest way to get to the intended one. Obviously you might know your environment and should be in position to ascertain whether this is the case or not.
Nov
8
comment How to deal with a hacked laptop that's being remotely monitored
@Raja Dey - after the re-installation, 1) make sure the first thing you do with your Ubuntu is to update and patch your system. 2) Do not open or use anything that this 'friend' has ever sent you. 3) Change your router's password, just in case. 4) Change all your passwords to services which you have logged using your home computer or home network. 5) Tell this person he is a worthless piece of <user-your-imagination> and don't ever trust him again.