3,229 reputation
1822
bio website blog.bstpierre.org
location United States
age 39
visits member for 3 years, 2 months
seen Aug 12 at 3:27

Hey


Feb
3
comment Most secure data storage?
I want to +1 for the vicious dogs, but then you have to figure out how to store all that dog food...
Feb
1
comment Does the method of Internet connection affect the security of your the network?
Similar to: security.stackexchange.com/q/9008/2980
Jan
26
comment Best way to test my home network from the outside
@TateHansen: Good point. That is why I recommended the step in the third paragraph: open a port on your home router and verify that you can see the port as open so that you know it was filtered by the router and not somewhere between the scanner and the router.
Jan
24
comment Best way to test my home network from the outside
@snowape: I don't know for sure, but FWIW I've heard that Amazon doesn't permit scans from their VPS. Check the TOS.
Jan
24
comment Best way to test my home network from the outside
@snowape: Sorry for the ambiguity: "ISP" is providing the pipe to your home, "VPS" is providing a cloud server. Two different, but related, issues. (1) Check the TOS on your VPS. When I checked, Linode didn't care about running scans -- though I'm pretty sure they'd care if they started getting abuse complaints. (2) Check with your home ISP to see if a scan is going to generate an abuse complaint. Probably not, but it doesn't hurt to ask and it can avoid getting hit with a complaint at your VPS account. I've never had a problem with infrequent scans even without notification on either side.
Jan
24
comment Best way to test my home network from the outside
@lszi: That would work, but I generally prefer to avoid disturbing the SUT so that I don't introduce a change that invalidates the test. Setting up dhcpd to hand out a single IP address isn't that hard.
Jan
21
comment Protecting emails in your database
Are you asking about customer email addresses or the actual content of email messages?
Jan
19
comment Bypassing XSS filters
See also: security.stackexchange.com/questions/164/new-xss-cheatsheet
Jan
16
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
+1 for comparing PHP to rats as an indirect plague vector!
Jan
10
comment Is a password protected PDF file safe for bank statement attachments?
@lszi: In the US you might start with the OTS (Office of Thrift Supervision), but I doubt you'd get anywhere. Easier to switch banks (which is not easy -- I don't say this lightly).
Jan
6
comment How many authentication factors are there?
"Somewhere you are" could also require being physically present in front of a given system.
Jan
6
comment Encrypt files on flash drive for easy decryption
+1 -- the OP is asking the wrong question. The real question is "How can I give files to my non-computer-savvy accountant?" The flash drive is a distraction.
Jan
5
comment With which algorithm I can prevent a brute force on a login?
@e-sushi: I agree with what Rory said, +1 if you update your answer. Also, when I said DoS the admin, I interpreted what the OP said about having the admin locked out of his account because someone tried to login using that account. OP also specified no captcha.
Jan
4
comment With which algorithm I can prevent a brute force on a login?
Sure, that would work (see my answer), you should mention that second layer in your answer. A naïve implementation of lockout as described in your answer could be used to DoS the admin.
Jan
4
comment With which algorithm I can prevent a brute force on a login?
The problem with this approach is that I can block your access to the system if I know your username. I don't even have to want to access your account, all I have to do is enter "password" three times and now you're blocked until tomorrow, at which point I can block you again (...or my crond can block you again).
Jan
4
comment Difference between vulnerabilities on windows/linux/mac for same program
+1, see also 64-bit-specific vulns, e.g. guninski.com/where_do_you_want_billg_to_go_today_4.html
Jan
2
comment Secure one-time-use credit cards
You'd probably get answers more focused on the money/consumer side on money.SE.
Jan
1
comment How to implement secure device identification in a for-pay wifi router to prevent usage fraud?
+1 for strong crypto. Anything else is just a hack.
Dec
28
comment Setting up a honeypot
@ryyst: Some ISPs may filter traffic so that ports 137-139 (and others) can't even reach you. I'd suggest running a "noisy" port scan on the ports you want to reach from a host on another network. Watch your logs when you run the scan -- if you don't see your scan, then the packets are probably getting filtered by your ISP. (Don't run a "stealth" scan -- these packets won't show up in your logs by design.)
Dec
26
comment Public wifi security protocols
@Jason: What you're talking about is called a man-in-the-middle ("MITM") attack. I'm not sure if IPsec is less vulnerable to MITM than SSL, but you might find it instructive to read about SSL in this question -- I think the answers by AviD and Tronic are instructive. For SSH, if an attacker pretends to be your VPS, you will get a message from your SSH client telling you that the attacker's key does not match your server's key -- i.e. you will be aware of the attack and you can drop the connection before sending any confidential data.