22,671 reputation
35081
bio website
location
age
visits member for 3 years, 11 months
seen 4 hours ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


16h
comment PCI Compliance and fines
No breached organization is PCI compliant, ever. No matter what you were 5 minutes before the breach. There is no immunity based on your prior status.
1d
comment Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1
I'm sorry, I missed those other sites being mentioned. You're right, that makes this less likely. One other thing to check would be the trusted root and intermediate certificate store on the different clients; look at the certificate chain as reported by the browser in the two cases and make sure it's the same chain. There are legitimate reasons they might differ, and perhaps one browser is using a SHA-1 signed intermediate and the other using a new SHA-2 signed cert.
Jul
1
comment What can hackers do with ability to read /etc/passwd?
@Nick, correct me if I'm mistaken, but ls -l will stop showing usernames if you remove /etc/passwd; it's not PAM-aware. That's the sort of hidden dependency that drove hashes out of /etc/passwd.
Jul
1
reviewed Close Is it true that breaking into the https padlock settings on a web page is easy to do?
Jul
1
reviewed Leave Open Security Assessment v/s Security Engagement Breakdown
Jul
1
reviewed Close Changing the signature on a cert or creating a key file from an existing cert
Jul
1
reviewed Close Neighbors Internet Kicks My PPEOE Off
Jul
1
reviewed Close Hiding (Obfuscating) Java script
Jul
1
reviewed Close How do I decrypt a RSA-SHA1 code?
Jul
1
awarded  Good Answer
Jul
1
awarded  Nice Answer
Jun
30
comment What can hackers do with ability to read /etc/passwd?
@SteveSether thanks, good point, modified to reflect.
Jun
30
revised What can hackers do with ability to read /etc/passwd?
Incorporated @SteveSether's suggestion
Jun
30
answered What can hackers do with ability to read /etc/passwd?
Jun
30
revised Changing the signature on a cert or creating a key file from an existing cert
:s/pubic/public/
Jun
30
comment Why not fix Android root exploit?
Speaking generically, it is impossible to secure a platform that the attacker has physical control over.
Jun
27
revised What is an ITGC Audit?
:s/you're/your/
Jun
26
answered What is an ITGC Audit?
Jun
25
answered HTTPS: is the data downloaded when loading a page encrypted?
Jun
25
answered Dump linux password in clear text