Reputation
1,161
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
2 8 8
Newest
 Pundit
Impact
~9k people reached

  • 0 posts edited
  • 0 helpful flags
  • 18 votes cast
Feb
18
comment What's the danger of having some random, out of my control, JavaScript code running on my pages?
Related: Forbes says no to adblockers...‌​, and then serves up Malware... Why is it related? because third party software (in this case, advertisements) got hijacked to server malware (password stealing). I highly doubt Forbes did it on purpose, but it happened none the less.
Feb
12
comment Script Kiddies - how do they find my server IP?
"how can I hide my stuff online?" I would add change default ports... "script kiddies" are looking for easy targets... 80/443/22/etc... if you aren't online yet, change it to 81/444/23/etc... or 55080/55443/55022/etc... or whatever... Don't rely on this to protect you, but it will mitigate a LARGE portion of the automated attacks - especially if you aren't online. Switch back when you are ready.
Feb
2
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
They hold that its inner working should be kept a secret, so that no one can reverse engineer it. The reason for stuff being reverse engineered? Because it's unknown...
Oct
1
comment How to securely send private keys
RFC1149 - the only way for messages to fly securly
Sep
29
comment How do I purge Windows of my private data when formatting the drive is not an option?
Is it actually written down that you are banned from reinstalling windows OR is it simply that the computer must be usable for the next person? I would argue a clean install for the next person would be the RESPONSIBLE thing since it guarantees a cleaner, faster experience. I'd be irritated if I got a half loaded-down sluggish system as the next person...
Sep
29
comment Is password reuse a problem if the password is very strong?
Who cares what Confucius say... it's all about what XKCD say.
Jul
31
comment Is my modem compromised?
@wuiyang I recommend a chainsaw followed by gas. Make sure you do it in a well ventilated room or outside.
Jul
29
comment Could malware move during a scan to avoid detection?
Assuming the malware doesn't have "lower" hooks... The question becomes, who has the lowest level hooks? If the malware/rootkits hooks are low enough, they can lie well enough...
Jul
2
comment Unsubscribe safely
@LorenPechtel Personally, I would put those in Bad(Unknown). If Dewalt sends me an email because they got my Address from Lowe's - it's still not something I personally signed up for IMO (even if the small print says Lowe's will share with affiliates). It's unexpected and gets the Report Spam Gmail Salute from lil ole me. It's more of a grey area, since I "trust" "Lowe's".
Jun
30
comment Unsubscribe safely
@JaredBurrows Well, I assume (You know what happens when you assume?) it would be. CURL is going to be simpler - no plugins like Flash, javascript, etc - so that would mean a smaller attack surface. On the flip side... Good and Bad messages can be linked to a secondary page that requires interaction: Are you sure you want to do this? Why? Do you not care about our children? Is it really you clicking the link or are you lying to us (and our poor destitute childred)? that CURL wouldn't be able to interact with.
Jun
30
comment Unsubscribe safely
@JaredBurrows I don't think "how" you click a link (In the gmail web app, in outlook, copy/past link into Netscape Navigator or sending a pigeon... or via CURL) matters in this regard. The question is do "They" know "this" email address is active? If you respond to it in any way, they do. If it's a company you deal with (etc: Lowe's), the know you use this email and the question of "is this email active" is irrelevant so click away... if it's an unknown company, they don't know until you "respond" - even if via CURL.
Jun
30
comment Unsubscribe safely
@Nrc if it's unclear, I'd personally err on the side of not clicking. (or clicking "Mark as spam" in google and forgetting about it)
Jun
30
comment Unsubscribe safely
@Danny. I have heard that is better to **never click to any link in an email**. Is it a bad idea to click to a unsubscribe link? What is the best way to unsubscribe to undesired mails? - Emphasis/paraphrase: "ANY link in ANY email". "Undesired" could be stuff you signed up for (like Lowes Weekly Specials in my example). I would say this question is more broad than "bad".
Jun
28
comment How critical is it to keep your password length secret?
Or lying to waste effort: I have an 18 long(when really it's 16... , or vice versa)
Jun
12
comment How is Gmail susceptible to brute-force attacks?
Oblig: XKCD: Password Reuse Password Entropy is rarely relevant. The real modern danger is password resuse.
Mar
10
comment How to prevent network administrators from accessing USB drive
@immibis if you are worried that your workers have patched/rooted your servers... you have bigger issues. Like why you haven't fired someone you distrust that much?
Nov
27
comment How do you explain to experts that a database server should not reside in the DMZ?
If you aren't holding Credit Card details, what are you holding? Account information? Patient visit information? blueprints for American Made UFOs? If it's that sensitive, maybe you should aim for that level of security or similar levels demanded by say Electronic Health Record systems used for Patient info. No CC info there, but you be screwed sideways if you lose THAT database....
Aug
13
comment Can we trust antivirus software?
@user2813274 CYA can be one of many reasons. Expertise, accountability, vettability, regulations, etc... many reasons outside of finger pointing to consider when purchasing security software (not just AV). Trust also helps keep providers in check. Look at all the blowback from NSA related issues. What company is going to voluntarily install a backdoor when they can lose face and customers?
Jul
29
comment Does clicking lead to DoS attack?
@Bergi The question is: Can simple clicks lead to DoS? Specifically, me clicking real fast (paraphrased). Of course the bandwidth available will affect how many clicks lead to a "DoS". A self-hosted website, behind a home connection will need much fewer clicks than something hosted on a high-availability AWS... This question made me think of the slashdot effect because that's basically what it is, death by a million clicks.
Jul
29
comment Does clicking lead to DoS attack?
see related: en.wikipedia.org/wiki/Slashdot_effect - lots of honest traffic (flash mob) causing a website to go down. Just people clicking to view the site. Not that far of a stretch of many people clicking a link once... to one person clicking many times.