636 reputation
28
bio website ca.linkedin.com/in/…
location Oshawa, Canada
age 38
visits member for 2 years
seen yesterday

Senior Network Analyst at Town of Whitby, Ontario, Canada

combined Stack Exchange profile for Rod MacPherson


May
10
awarded  Yearling
May
7
comment “Optimal” Web Server SSL Cipher Suite Configuration
Qualys (SSL Labs) shows which will work with the default out of the box settings, not which can be made to work. If you test a site that has all SSL and TLS 1.0 disabled it shows no version of IE other than 11 working, but most of the IE configurations can be made to work with TLS 1.1 or even 1.2 by checking a tick box in the settings.
May
5
comment Bring your own phone to a (new) job: Consequences?
By either enforcing a proxy or installing a trusted CA certificate could they not also do all that on HTTPS traffic as well? I'm not terribly familiar with iPhone, but it seems to me that is a technically possible situation. Legal matters aside, after all, IANAL.
May
5
comment Why is PDF still safe?
@arc-lupus This is precisely why security is done in layers. If, say you have an HR e-mail address that regularly gets PDFs from multiple unknown sources (resumes) it would be ideal to have the machine where those are viewed be more heavily restricted in what it can do on the network, and more closely monitored. If someone is planting malware in a PDF, they probably want to use it as a way to get into the network, or a way to cause havok on the network. If you limit what that computer can get to, you reduce the risk.
May
4
comment Are captchas based on ASCII art secure enough?
It can depend a lot on how big the threat is from spam bots. If it is unlikely that someone would bother to put any effort in at all you can get away with even a non-image based "captcha" I hesitate to call it a captcha even because it's not really... for example, I've run across sites where they just have in plain text a simple addition/subtraction question. something like 3+1= This is trivial for anyone with any minimal level of coding experience to bypass, but it works for them because the kinds of bots they were getting were not specifically targeting them, so it was good enough.
Apr
28
comment How to publish scanned documents anonymously?
Also, be aware that while not normally visible, even a cheap scanner does pick up part of what is on the opposite side of the page and with processing it is possible to see that, so be sure that there are no identifying marks on the other side of your page.
Apr
28
answered Can anyone tell if a wireless router is plugged into an Ethernet port (without actually seeing it)
May
21
answered What benefit is there to adding a password to your SSH key?
May
10
awarded  Yearling
Dec
13
comment Helpdesk role and local admins
If you absolutely need to have "power users" log into their machines as local admins then why can you not add the helpdesk-localadmin group to the local admin list too?
Dec
9
comment What security products are necessary or advised for a home computer running Windows?
I do think that my previous answer was OK, as there is only one product I know of that fits this description, but I will avoid mentioning the name so I don't get my comment deleted again. There are protections such as DEP, SEHOP, and ASLR. Normally these have to be implemented at a programming level, but a certain program is available that will sit between the OS and any other program you want it to and watch for attempted buffer overflows, etc. It runs beside AV & when applied to internet facing programs like IE, Adobe Reader, Chrome, Windows Media Player... will help block even 0 Days.
Nov
28
comment PCI Compliance Distibution
Please check your terminology. Breaches are break-ins. Vulnerabilities are ways to break in. Trustwave reported several vulnerabilities, not breaches... unless you went beyond the Trustwave ASV scans and hired them to come in and do forensics.
Nov
1
answered How serious is InstallIQ?
Oct
24
comment Is there any point to keeping a “Verified by X” image on the page for a page secured by SSL?
I recall dealing with a vendor of some hosted service or another last year who had a new web based service that they were trying to sell us and the site had one of those logos but it was http:// and a wireshark capture using the site showed that no part of it, not even the login process went over https:// We talked to them about it and they insisted it was secure. They had not even set up their server to use SSL/TLS as an option, but they fully believed that because they bought a certificate and pasted the logo code onto the site it was secure.
Oct
3
comment How force that all connections to my Apache use TLSv1.1 or TLSv1.2?
What are your SSLCipherSuite settings?
Oct
3
answered How can a non-technical user verify a message was sent “securely”? …or over TLS?
Sep
25
comment Hotspot with same SSID, how does authorization work?
@TerryChia Just trying to make it easy to understand and interesting to read. Tom already tried a technical answer.
Sep
24
comment Hotspot with same SSID, how does authorization work?
Witha malicious AP trying to spoof the exchange would look like this .... AP: "here's my ID" PC: "That's so fake!" rolls eyes and walks away. :)
Sep
24
comment Hotspot with same SSID, how does authorization work?
Your Laptop won't send the credentials to an access point using PEAP if it has not yet verified that it is the correct AP by checking the certificate that the AP sends to it. The exchange should go like this (roughly): AP: "Hi everyone, I'm the university AP" PC: "Hi AP, I'm a laptop that belongs on your network" AP: "Cool PC, we're still using PEAP, so here is my ID" PC: " yup, looks good to me, my user is JochemKuijpers" AP: "what's his password?" PC: "sdfsjkafsk" AP: after whispering to a server behind him "That checks out, come on in"
Sep
19
answered Two-Step vs. Two-Factor Authentication - Is there a difference?