23,096 reputation
35384
bio website
location
age
visits member for 4 years
seen 3 hours ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


4h
comment Input Sanitization vs Output Sanitization
I'd like to see a reference to anyone saying you should not sanitize inputs.
12h
comment When do system access policies start to become source of security incidents?
There's no good answer for "where's the line between too loose and too tight a security policy"; it's opinion based, varies from organization to organization and even then is hardly ever quantifiable unless there's a compromise that gets tied back to policy with 20-20 hindsight.
15h
answered Centralized local hosted web based password manager
16h
comment Centralized local hosted web based password manager
Should we assume you only care about free/open source solutions? There are several commercial solutions but that's not the vibe I'm getting from your question.
18h
comment What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
@SimonEast, yes it is. See How to determine if mail was encrypted during transport using the header information? and How to check that an e-mail service provides encryption between the mail servers?.
1d
awarded  Guru
2d
revised Are TLS session keys cached in a browser?
added 951 characters in body
2d
answered Are TLS session keys cached in a browser?
2d
answered Is this the end of malware use of DNS?
2d
awarded  Organizer
2d
revised What is legally required to store HIPAA data in the “cloud”?
Replaced HIPPA with HIPAA.
2d
comment How do browsers negotiate SSL/TLS connection parameters?
@boleslaw.smialy, I've tried to address your followups with edits to the answer. Hope that helps!
2d
revised How do browsers negotiate SSL/TLS connection parameters?
Attempted to address comments
Jul
25
answered Using BIN part of PAN in a webservice
Jul
25
awarded  Constituent
Jul
24
revised How do browsers negotiate SSL/TLS connection parameters?
added 910 characters in body
Jul
24
answered How do browsers negotiate SSL/TLS connection parameters?
Jul
24
comment How do browsers negotiate SSL/TLS connection parameters?
Is there a particular browser you're interested in? They use different mechanisms.
Jul
23
comment Does setting a default DROP policy actually improve security?
In my experience pentesting /24s on the Internet it's not "5 minutes to an hour" it's "days to weeks". I agree that in a technical sense there's always enough time to scan either way, but humans are not the most patient of beasts.
Jul
23
answered Does setting a default DROP policy actually improve security?