29,676 reputation
753111
bio website raesene.github.io
location Scotland, United Kingdom
age 94
visits member for 4 years, 6 months
seen 12 hours ago

I'm an IT Security professional based in Scotland. I've been in IT Security for over x years now, with the last x-5 focusing on penetration testing/ethical hacking.

Currently a managing consultant with a large provider of security testing services.

Any opinions expressed here are purely my own and not necessarily those of my employer.


May
12
awarded  Notable Question
May
9
awarded  Nice Answer
May
8
comment Is it safe to trust a Docker container?
well stealing credentials (username/password) doesn't provide necesarily the same level of compromise as stealing signing keys. Ideally signing keys should be held offline and use to sign releases. this increases the trust you can place in the software you receive.
May
8
comment Is it safe to trust a Docker container?
no worries, they're similar meaning/sounding terms so easy to mix up..
May
8
comment Is it safe to trust a Docker container?
if you see my edit above, the docker people themselves state that container signing isn't in place as yet, so I think that's also the meaning they're looking at...
May
8
revised Is it safe to trust a Docker container?
added ref to CIS guide
May
8
comment Is it safe to trust a Docker container?
direct modification of the git repos wasn't I think an issue there, but that doesn't mean you can rely on software from github, if someone steals the creds of a developer they can just push a new version to the repository. crypto signing of a release helps to mitigate that risk and ensure you're getting the software you intend.
May
8
comment Is it safe to trust a Docker container?
I think you might be confusing integrity signing with cryptographic signing. Git does provide integrity checks to prevent corruption, but it does not provide cryptographic signing of a release to prevent tampering.
May
8
answered Is it safe to trust a Docker container?
Apr
29
awarded  Famous Question
Apr
26
reviewed Close If EMV can't be copied/cloned, how will companies like plastc do it?
Apr
26
comment If EMV can't be copied/cloned, how will companies like plastc do it?
if you believe their FAQ plastc.com/faqs they can clone EMV cards, however this seems ... unlikely
Apr
26
reviewed Close Securely delete a file in Ubuntu?
Apr
26
reviewed Close Win server 2008 partition security
Apr
26
reviewed Close Android email encryption
Apr
26
reviewed Close Suspicious wifi networks from distant places and hotels
Apr
26
reviewed Leave Open Is Cryptree suitable for cloud storage?
Apr
24
comment Solution for Protocol Downgrade Attacks
when you say you "have protocol downgrade attacks" on your server what exactly do you mean? For example have you been given a finding in a security audit? If so, what is the finding you've been given? Also it would help to know what web server you're using.
Apr
16
reviewed Approve Web Crawler for ASP.NET site
Apr
16
revised Suspicious SMS getting received on selected browsing
removed ads tag