19,547 reputation
350103
bio website stackexchange.com/users/…
location
age
visits member for 4 years, 2 months
seen 7 hours ago

Moderator♦ pro tempore on French Language, Computer Science and Software Recommendations. I'm also a unix amateur, and a developer on embedded systems with a computer science background and security leanings by trade.

Avatar picture slightly adapted from a photo by Luridiformis (Zonda Grattus).


1d
reviewed Leave Open Tools to scan for PII
1d
reviewed Close Can anyone suggest good open source tools for scanning source code for vulnerabilities?
1d
reviewed Close Cryptography key gathering tool
1d
reviewed Leave Open Looking for Information security / risk management table top or card games
1d
reviewed Leave Open Is there a tool to verify browser TLS/SSL configuration
1d
reviewed Close Secure source code review tool for jQuery
1d
reviewed Leave Open MITRE's UEFI 'Extreme Privilege Escalation' and HP's SureStart
1d
reviewed Leave Open Does a random number after the login name in the public members section of a website increase security or privacy?
1d
comment TLS authentication on Openvpn server
Since this question is about configuring Openvpn for interoperability, rather than about achieving a security policy, it's off-topic here and should be asked on Super User or Unix & Linux instead.
1d
reviewed Close TLS authentication on Openvpn server
1d
reviewed Leave Open Some sites require that you accept cookies in order to use them. Does this mean that they can read/track my real IP?
1d
reviewed Leave Open WPA2 audit tool
1d
reviewed Leave Open Windows security policy analysis tool
1d
reviewed Leave Open rancid like tool for config files
1d
reviewed Leave Open Affordable web application attack tools
1d
reviewed Close Firewall audit log management tools
1d
reviewed Leave Open Automated tools for Cisco IOS config auditing?
Jan
22
comment How to correctly secure a ssh session against MITM attack?
@LonnieBest Yes if the client doesn't already know the server's key, no if the client already does. This holds whether the client authenticates with a key or with a password or any other method. If the MITM happens and is not detected, then with a password, the attacker can initiate new connections to the server, which I think can't happen with the key. However the MITM can also infect the server with malware (e.g. add a key to the authorized_keys file), which is more detectable than grabbing the password but bad anyway.
Jan
20
awarded  Nice Answer
Jan
20
comment What's the common pragmatic strategy for managing key pairs?
@dolmen From my old home PC to my new one, I cloned my home directory. Machines in the same realm includes cases like shared home directories over NFS where sharing SSH keys is inevitable. If you're worried about copying private keys between two machines then they aren't in the same realm.