14,772 reputation
23253
bio website
location
age
visits member for 3 years, 5 months
seen 1 hour ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


21h
answered Decrypting packet data without private key
2d
comment Connecting to postgres with SSL
My sentence meant "unauthorized" :). TLS is one layer. You're trying to use it where it isn't necessary, and you're going to have problems because the system has expectations. If you'd like to bang your head against the wall, feel free, just don't do it under the illusion you're actually improving your security in any meaningful way.
2d
comment Connecting to postgres with SSL
An authorized process with the privileges required to sniff has the privileges required to scrape memory, trace your process, assume SYSTEM, etc. etc. So the extra hardening of local "network" doesn't really add much.
2d
comment Connecting to postgres with SSL
Using TLS doesn't gain you anything on 127.0.0.1, so you might as well allow SYSTEM in without it.
Dec
19
answered Does sending credit card info over email violates PCI DSS?
Dec
18
comment What is stored on a banking card and how is it protected?
It's worth pointing out that both old (magstripe) and new ("chip and pin") cards both use a "pin", so you can't use "pin" to distinguish between the two. Of course, with the old style card, the "pin" is only meaningful as checked by the mainframe at the bank...
Dec
18
revised What is stored on a banking card and how is it protected?
expanded a bit.
Dec
18
answered What is stored on a banking card and how is it protected?
Dec
18
comment PCI-DSS Requirement for Application Level Security?
Technically, in a PCI audit, it's not a finding unless it fails at least one requirement. So they absolutely should. I can't promise you that all ROCs (Report On Compliance) are written with the clarity they should have, though. Would love to hear, from a QSA QA or a card brand reviewer who sees a lot of ROCs, what the expectations really are.
Dec
17
answered PCI Compliant Secure Vault Design and Implementation
Dec
17
comment PCI Compliant Secure Vault Design and Implementation
The phrase 'vault' doesn't show up in the DSS itself. Can you link to some of the documents you're describing?
Dec
17
awarded  Nice Answer
Dec
17
awarded  network
Dec
17
awarded  tls
Dec
17
revised What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?
corrected and referenced updated side info contributed by commenter
Dec
16
comment PCI DSS - Recorded Phone Conversations
Call centers I've called that needed the CVV will say "I'm going to transfer you to another system to type in your CVV; wait until you're asked then type it in and press pound and you'll come back to me." That small segment of the call goes unrecorded, and after pressing pound you're shunted back to the recorded portion of the system. So, yeah, the technology exists. If you're already using call center software, ask them how they help you with PCI compliance.
Dec
16
answered What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?
Dec
16
revised PCI DSS - Recorded Phone Conversations
:s/Fish Next/FishNet/
Dec
16
answered PCI DSS - Recorded Phone Conversations
Dec
16
revised Determining PCI DSS SAQ level
Corrected factual mistake.