829 reputation
715
bio website None
location Netherlands
age 37
visits member for 3 years, 2 months
seen yesterday

Just a guy with some linux experience.


1d
comment Can ISP use MITM attack to “break” encrypted traffic?
There is at least one firewall manufacturer I'm aware of that explicitly uses MITM certificate shenanigans in order to decrypt HTTPS -- ostensibly just for application-level intrusion scanning, but traffic interception is possible as well.
Jul
5
comment Are two firewalls better than one?
Also, point of note, but almost all industry-grade firewalls in the market nowadays can handle a DMZ setup with only a single firewall box by maintaining different networks on different ethernet ports.
Jul
5
comment Are two firewalls better than one?
@user3395407 To summarize, all you manage to do with this setup is add another single point of failure and double your sysadmins' workload for an extremely limited and nebulous benefit at best. I'm sure they'll thank you for it.
Jul
5
comment Are two firewalls better than one?
@user3395407 This comment isn't large enough to list all the ways in which you don't understand what you're talking about here. Basically, if someone manages to "exploit" your outer firewall and gain administrative access, then you're hosed regardless of how many firewalls you put in behind that because the attacker can redirect and snoop pretty much all of your internet traffic unless you're planning to VPN everywhere.
Jul
5
comment Are two firewalls better than one?
No, the main disadvantage is that you've added another single point of failure in your network.
Jun
27
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
But still about an order of magnitude less tries than without fail2ban. Possibly enough to make the difference.
Jun
27
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
In the case of the botnet, assuming you've got something like fail2ban running and each bot only gets two tries before it's locked out for an hour, you're still putting up a decent defense...
Jun
27
comment Authenticating without a database
@D.W. is right -- in fact, any method for storing credentials is, once you start scaling it to real world uses and real world potential issues, going to boil down to "use something that behaves like a database would"
Jun
27
comment Authenticating without a database
@Stephane Not so much "problematic" -- but you've basically just described the point of using a database.
Jun
16
comment Can I prevent my neighbors, whom I pay for shared internet (wifi), from seeing the sites I've visited?
On the other hand, whoever you've configured your VPN with will be able to see what you're doing. As with everything on the internet, it ultimately boils down to who you trust.
Jun
7
answered How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?
Jun
1
answered How to prevent attacks to server
May
19
answered My server was used for sending spam. Will our server ever be trusted again?
May
19
comment Do heuristics exist for modeling the “harmlessness” of a file?
@blunders "lacks a basic understanding of security" pretty much sums up my opinion of people willing to trust a 'file profiling service' website rather than an actual virus scanner on their own system.
May
19
comment Do heuristics exist for modeling the “harmlessness” of a file?
@blunders ... and the instructions were to launch it, provide it with your in-game username and password, and it would handle everything else. Just because something doesn't contain a virus doesn't mean it's safe to execute.
May
19
comment Do heuristics exist for modeling the “harmlessness” of a file?
@blunders Story time! I occasionally play an MMO named Warframe. Good fun, has a number of microtransacty things, lots of depth for a third person space ninja shooter. Couple weeks ago I got followed on Twitter by an obvious bot that advertised 'free platinum' (plat being the in-game for-purchase currency) that led to a website where you could download an app that promised to "hack" the game and provide you with a thousand plat a pop. The app itself was touted on a file processing service like mentioned in the question and certified virus free... (cont'd)
May
19
comment Can my company see what HTTPS sites I went to?
Short short version: Yes, they can probably tell where you've been. Don't want them to know about certain hobbies of yours, don't browse there on company time.
May
19
answered HTTPS encryption and internet proxy
May
19
comment Do heuristics exist for modeling the “harmlessness” of a file?
You forgot 3. This 'file processing service' is actually a scam to reassure gullible users into installing 'virus-free' malware.
May
18
comment How can a site know about insecure password?
Wish I could upvote more than once for that final line.