32,200 reputation
454113
bio website cloud101.eu
location Belgium
age 24
visits member for 3 years, 4 months
seen 19 secs ago

I'm a security analyst and consultant, I'm here to learn and help others out.

Opinions are my own. Advice provided with no warranty.

Find me on http://cloud101.eu


3m
comment Storing CardHolder Data using RC2 encryption
Well if you don't store any data at any point. This means also in your logs and possible crashdumps! If you just transmit it the payment gateway, I suspect you might still need to be compliant. However one strategy might be to use a "redirect to" payment gateway so that the customer needn't input his CC details on your website, but on that of the payment gateway.
1d
awarded  Nice Answer
2d
awarded  Nice Answer
2d
comment How to trace a (mobile) phone?
It's most certainly possible. It's behavior based analysis. Check the reality mining project by MIT.
2d
comment Does Wifi encryption create a private tunnel between the adapter and the accesspoint?
arp poisoning on a wifi network... Just sniff the network
Nov
20
comment Penetration Testing on Thick Client Application
@Stephane to be fair he clearly tried several tools already, nobody knows everything.
Nov
20
answered Is it possible to get the salt if I have the hash and original password?
Nov
20
awarded  email
Nov
19
comment Is storing CVV compliant with PCI standards?
PCI-DSS is not about legality, it's about compliance with rules set forth by the credit card companies for performing transactions.
Nov
19
reviewed Edit suggested edit on How do I get the IP address and location from an email
Nov
19
revised How do I get the IP address and location from an email
Improved english, though some parts of the question are still unclear, I will ask for clarification.
Nov
19
answered How does Bayesian poisoning work?
Nov
18
comment What is a DNS poisoning attack and how does it work?
And if you read that post, you'd notice the first answer explains that quite clearly. -1.
Nov
18
reviewed Close Password automatically typed into user box on facebook
Nov
18
comment _ _ VIEWSTATE to Protect Against CSRF
They can't be read if you set the HTTPOnly flag.
Nov
13
comment RSS Feed Security warnings
There are services, they usually cost a few thousand a year. You can monitor the ones from NIST. But those include everything, not just specific technologies.
Nov
12
comment PCI Compliance and PayPal
You are required to perform regular pentests, they will scan your network also for default configurations and SSL ciphers used. 9/10 you will have to fix tons of stuff after the first audit. If you don't have an implementor on site who's experienced in PCI-DSS, you will probably fail first time around.
Nov
11
comment Encrypting sensitive data in a financial form
Honestly, this is a situation where I'd say, if you don't know how to do it, you shouldn't be building it. My advice is to contract a company that actual has experience in building these types of systems. Storing privacy sensitive data, such as social security number. Walk away.
Nov
11
answered PCI Compliance and PayPal
Nov
9
answered Protecting vs Securing