Reputation
1,075
Next privilege 2,000 Rep.
Edit questions and answers
Badges
8 13
Newest
 Yearling
Impact
~17k people reached

Aug
27
comment Man in the middle attack still possible against ssl?
You may want to add something about Strict Transport Security as a countermeasure too.
Aug
2
comment Why would one increment card security code for a new payment card
@NathanC Heck no, stay away from the lottery for the rest of your life! You used up your one lucky chance you get already.
Aug
2
awarded  Citizen Patrol
Jul
18
comment Can I avoid DNS spoofing by typing the IP address?
A good example of this, go ping security.stackexcange.com and you will likely get the ip 198.252.206.16, but if you visit that IP, you do not get this website.
Jun
23
comment Why can a Tor exit node decrypt data, but not the entry node?
@bonsaiviking Ahh, I see. You are the first person ever to be able to explain that. So its Me<--(TCP connection 1)-->Tor Entry point<--(Tor Protocol Stream)-->Tor Server<--(Tor Protocol Stream)-->Tor Server<--(Tor Protocol Stream)->Tor Exit Point<--(TCP connection 2)-->Destination Server So I only have a TCP connection to the entry point and the final destination only has a TCP connection to the exit point.
Jun
21
comment Routable Domain for DC?
To see a related topic to what Gordan talked about, see this old quetsion of mine.
Jun
2
accepted How to stop/detect someone else registering a certificate for my domain
Jun
2
asked How to stop/detect someone else registering a certificate for my domain
Jun
1
comment Recover Server 2008 R2 Domain Admin Password
Last question, is this the domain controller or just a server on the domain.
Jun
1
comment Recover Server 2008 R2 Domain Admin Password
Must the password be recovered or is resetting the password without ever learning what the old value was acceptable (I doubt it can be done due to your bitlocker use, but I just want the clarification in case someone besides me knows a way)
May
29
comment How secure is the Windows event log, and how is it secured?
If a machine is compromised there is no way to solve the problem locally. "If your machine can do it, then the malware can do it too". The only way to solve the the problems is store the logs in a way that the machine that is creating the log entry can not edit the log itself. That may be by using WORM media or by using a 2nd machine and doing log shipping. Now if the 2nd machine gets infected too all bets are off again as the malware can just edit the logs again.
May
29
comment How secure is the Windows event log, and how is it secured?
Iszi told you already. Windows file permissions on the %SystemRoot%\System32\Winevt\Logs\ directory is the only security measure that is implemented out of the box. There is no tamper-resistance mechanisms in place other than permission restrictions. However Windows has made it easy to do log shipping as that is the "recommended" way of providing tamper-resistance.
May
29
comment Why can a Tor exit node decrypt data, but not the entry node?
I agree with Petey B, the return path of the TCP connection is kind of "hand waved" away. Could you update your answer to give a better explanation of how a reply packet (even something as simple as the SYN-ACK packet of the 3 way handshake) on the TCP connection is sent back through the tor network and get to the original sender?
May
5
awarded  Popular Question
Apr
29
comment What's the rationale behind Ctrl-Alt-Del for login
@D3C4FF Just because you can't intercept the message does not mean you can't tell windows what to do when it receives the message. The important phrase from Thomas' post is "without needing administrative rights"
Apr
26
awarded  Yearling
Mar
20
comment Why do APIs use API Keys instead of Usernames?
@SinanTaifour to use a real world example, your bank account number is a API Key, the information does not need to be kept secret, in-fact it is written on every check you hand out, however you don't go posting your bank account number on every billboard you find. Your PIN to use to call in and do phone banking would be your API Secret, you never reveal that to anyone.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
Fair enough, good reason too.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
You can get a offline copy of your database and a javascript app that can decrypt the database. Also the encryption is all done client side so the server is only storing binary blobs without access to the symmetric key. (that's why their "forgot your password" page does not give you a new password (it can't!), it just tells you your password hint you recorded at signup)
Jan
5
answered How to test security of an encryption algorithm?