Eric G

3,006 reputation

425

bio	website	ericgoldman.name
	location	Chicago, IL
	age
visits	member for	1 year, 8 months
	seen	yesterday
stats	profile views	81

Currently, IT Security Consultant for multinational, focusing on application risk. Previously IT Auditor for a large accounting firm, where I performed IT Audits and Pen Testing for financial services, healthcare, and other industries.

	3,006 reputation	bio	website	ericgoldman.name	visits	member for	1 year, 8 months
425 badges		location	Chicago, IL		seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

111 Comments

suggestions reviews revisions comments badges posts accepts all

May 13	comment	Does versioning an encrypted file make it less secure? A factor to consider in general is compression and any patterns that may create, however, specifically for KeePass this is not going to likely come into play
May 9	comment	Best Security Software Jenny, you may want to try to improve your question to better fit the sec.SE format, see the FAQ: security.stackexchange.com/faq#dontask
May 8	comment	Per-transfer authorization of file transfers on a per transaction basis Likely financial services institution, but hopefully he should clarify. The fact that a bank does it one way should not be benchmark, though.
May 1	comment	Are these two ways safe? Please provide more details about the platform and what you are trying to do. It sounds like you are trying to avoid authentication and session management?
Apr 30	comment	A standard way to manually add a digital signature to a pdf file? @romancanada you can try to edit your question to clarify the rest of your points.
Apr 26	comment	Is it safe to allow users multiple login at different browsers & computers? I would argue the multiple mutations issue is not as big a threat, take something like Google docs where two users can edit the same open file. The server processes things in the order received, can be problematic, but not neccesarily a security concern
Apr 26	comment	Is it safe to allow users multiple login at different browsers & computers? Google allows multiple logins because they are tracking multiple factors in the backend, such as country, IP, etc. They also are likely mapping your patterns, have options for multi-factor authentication, and have a lot of monitoring. My guess is the downvotes resulted from saying that google does it so it must be okay. The risks and ability to mitigate risks will differ from org to org.
Apr 26	comment	Security precautions for shared iPads in a customer facing corporate environment Is (1) just a remote desktop suggestion, or another avenue? If remote desktop, what solutions work and still provide the "iPad" goodness of using fingers, low latency, apps. etc. Want to look slick for the customers, not an iPad logging into a windows desktop :-) For (2), can you provide more detail in your response - will this integrate with AD/LDAP, etc or is this just local users / local auth.
Apr 26	comment	Security precautions for shared iPads in a customer facing corporate environment Let's go on the assumption that the C-Level guys think iPads are cool and are driving this against the wishes of IT (that never happens anywhere, right?). Even if all the apps were web based, I imagine there should still be concerns over credentials, PDFs that get loaded, email app (maybe they will use web based email, maybe not), printing, etc.
Apr 24	comment	Is there any security threat with open WiFi connection? You should clarify your answer in regards to the "fine" you note. This may only be in some countries (i.e., India). In addition, the OP notes he is connecting to a insecure network, not setting one up.
Apr 24	comment	What is the disadvantage of using spoofing protected version of ARP protocol Can you post the title of the article you were trying to read from IEEE, some others may have access and may be able to read and comment.
Apr 22	comment	Is there any SQL injection for this PHP login example? If you are new to PHP, I would not recommend writing your own logon form. I would try to plug in some framework or at least find an example where the author stresses security in the title. You should of course now how to look for faults, but there are many complexities and bad things that can happen even beyond SQL injection from a logon form.
Apr 19	comment	Using / finding covert channels in inter-process communication everything is on the same host, e.g., no network only writing to named pipes?
Apr 18	comment	Using / finding covert channels in inter-process communication Can you clarify a little? You get to logon to the server, and observe communications? Or you only get to connect to the server with a version of the client? If you have access to the server, you have a regular user account that can't capture traffic or open privileged files?
Apr 17	comment	Security concerns with malicious NFC tags? I reviewed the other questions when originally authoring, but I wanted to talk about malicious things which can specifically be done with a limitation of tags instead of more complex and interactive systems like payments, etc.
Apr 17	comment	Security concerns with malicious NFC tags? I understand how the Tasker scenario works, but that doesn't mean its not possible to write an application that is always listening and reading tags and would automatically launch a URL. The scenario in my last comment was finding a tag with a specific action which is known, then cloning, and replacing another tag elsewhere with that cloned value. As I noted, it would be limited attack to that person, messing with trust in his/her own tags.
Apr 17	comment	Security concerns with malicious NFC tags? In terms of MiTM attacks on the NFC or easdropping, is there any type of verification or integrity check when reading a NFC or is it really your reader is listening for some id code in a broadcast/anycast type fashion?
Apr 17	comment	Security concerns with malicious NFC tags? Are there no public use of such tags? I imagine over time people would see the convenience over even QR code. Imagine a museum with a tag on the placard next to a painting. With any type of input you can require a check before processing. I imagine a limited attack would be changing the codes to that of a different code (turn on airplane mode vs turn on) if you cloned it to do a limited DoS.
Apr 17	comment	Security concerns with malicious NFC tags? A simple attack on QR code is to replace an expected code with another. If there is a flyer with a QR code and a note "click here to go to the page", if someone places a sticker over the code you may not be able to tell the page has been substituted.
Apr 17	comment	Automatic router admin password change Its sounds like he is asking why/how is getting attacked through some type of drive by, with cleanup this could be salvageable question.