3,855 reputation
1825
bio website
location Boston, MA
age
visits member for 3 years, 9 months
seen Jul 7 at 21:06

Jun
6
comment Why is 8ms a goal for hashing?
And with things like AWS, the money required for 200x computing resources * 1 month is a more useful calculation. Because if it is "embarrassing parallel" and you can use utility computing, it all comes down to how much money you want to spend on cracking it.
Feb
12
comment Is there a difference between GET and POST for web application security?
What are PUT and DELETE for?
Jan
25
comment Would publishing a network diagram make the network less secure?
I agree with your conclusion that review is normally much more valuable than obscurity. I'm just saying using obscurity as a layer can definitely increase security. Obscurity doesn't provide any hard security guarantees, but it can provide real world benefits.
Jan
25
comment Would publishing a network diagram make the network less secure?
I have to disagree with your original premise. Some amount of security is provided by obscurity, but the sentiment is that you shouldn't rely on obscurity alone for security. If you are provably secure, obscurity doesn't matter, but there are always weakness somewhere.
Nov
30
comment Dangers of opening up a wide range of ports? (mosh)
I'm not sure you want your EMR server accessible from the internet anyway. Even if you do, I think you could reduce the ports down to a manageable range and then ensure nothing else is using those ports (including a UDP port scan). I would imagine that your EMR application probably uses TCP though.
Oct
20
comment My company policy states I must put all passwords in a password safe shared with management. Is this secure?
I guess you have plausible deniability about everything that happens with your accounts now.
Oct
8
comment How to secure data before returning Macbook Air?
@Luc How to you securely wipe SSDs?
Oct
1
comment How expensive is it to guess a 15 character password, and should I be worried?
You could also spend the $1,000,000 in a shorter amount of time using EC2 or some other cloud, but it's more cost effective to have your own hardware. I just wanted to point out the time-cost tradeoff isn't as big anymore.
Sep
14
comment How to mitigate the risk of a continuous integration service security breach?
@tdammers Agreed, but it didn't seem like it was considered. One more piece of complexity to manage if doing 2 builds and testing one. Besides building on 2 different machines.
Sep
10
comment Is MD5 considered insecure?
Using GPUs you can get 33.1Billion hashes a second for MD5. 6 char passwords are instantly toast.
Sep
10
comment Global Blackout is a myth?
HTTP does not require DNS. Most uses of HTTP probably use DNS, so such an attack would disrupt most services on the internet, but as mentioned by other posts, there are countermeasures (caches for one).
Sep
10
comment Why are CSRF tokens necessary?
+1 replay attack
Sep
7
comment Convince the company not to store credit card numbers in our webapp
What law would make the CFO go to jail for non-PCI compliance?
Sep
7
comment Minimum requrements for storing last 4 digits of credit card number?
@eficker "you will be held liable and sued by any that suffer a loss as a result." That's a lot different than being slapped with PCI compliance penalties. I have no idea how you get cardholder data, which is the whole reason i asked about when you come under PCI rules (your answer was that you are automatically subject to PCI rules the second you process or store cardholder information).
Sep
7
comment Minimum requrements for storing last 4 digits of credit card number?
@eficker: How exactly am i wrong? PCI-DSS compliance is only enforced via contract law. If you "process, store or transmit cardholder data," but haven't signed any contract you aren't liable under PCI compliance.
Sep
7
comment Minimum requrements for storing last 4 digits of credit card number?
Are you liable for PCI compliance because of a contract you sign to use Authorize.NET? AFAIK, PCI compliance only matters if you are contractually obligated since it isn't a law.
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
"since TrueCrypt needs admin permissions (thus if you go to an Internet cafe, or try to use a public terminal it won't work)" That's a good thing! You don't really want to go to all of this work and then decrypt that volume on a public terminal.
Sep
3
comment mitigating anonymous DOS (tor combined with pyloris)
I think the point is that you don't need a lot of requests. You just need to consume all of the worker threads/sockets.
Aug
30
comment How does changing your password every 90 days increase security?
@ayckoster: If the system stores the last 5 passwords, i only have to change the password 5 times in a row and then put my old password back in. Secondly, most systems aren't smart enough to prevent counting up when using the shift-key: 1=>!, 2=>@, etc.
Aug
30
comment Neural networks & anomaly detection
Ha. Sorry. Just read your profile. I know very little about ML, but I hope my link helps.