166 reputation
5
bio website syneticon.net
location Germany
age
visits member for 3 years, 8 months
seen yesterday

I am working for a company which is doing infrastructure operations and IT consulting jobs in Germany, Europe.

My sphere of activities includes virtualization topics, IP networking, storage, server operations, monitoring, backups and network security. I was awarded the Microsoft MVP title for Windows Networking for several years in the past, although my public activity on Microsoft-specific topics has declined seriously due to lack of time so it is not likely to happen again that soon.

If you need to get in touch, just mail the company: office@syneticon.net

If you are wondering about the avatar bunny, Ubisoft supplies a lot more to look at and wonder about.


2d
comment Is full disk encryption on a server in a secure data center pointless?
@André You might trust or not trust a particular implementation or even a particular manufacturer. But dismissing the entire featureset as untrustworthy just because there are issues with an entirely different feature on some disk's models seems like throwing out the baby with the bathwater.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
Look at it this way: are airbags pointless in a car equipped with ABS and ESP and driven only by licensed and professional drivers? No they are not. Because there is a residual failure risk of preventive measures, there needs to be a safety net for damage containment.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
@André the performance point is moot with self-encrypting drives. And using the well-proven transparent compression/decompression stack in this case is hardly any complexity addon on the software / OS side. You would have to do the key management, though.
May
23
comment Is full disk encryption on a server in a secure data center pointless?
@JohnVirgolino FDE is explicitly labeled as "Data at rest protection". Why should it add protection to an online, unlocked (i.e. decrypted) disk?
Dec
2
awarded  Commentator
Dec
2
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd there is a trust chain in X.509 certificates, but it is a chain of certification authorities only. Either way, the big CA players are not going to give up their gold mine easily, so we probably will see another couple of years go by before the PKI for the general public will start changing.
Dec
2
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd the point I am making that the certification authority for a name space belongs with the registration authority for this very name space - in the case of DNS names this would be the DNS zone admin. The exact mechanism of publication for the resulting certificates does not matter that much. But it seems I was mistaken about putting application keys into DNS. It has been a couple of years I have last tried to air this topic with IETF working group members. In the meantime, the DANE working group proposing this very thing has formed.
Dec
1
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd I understand the main line of reasoning is that DNS zones should not contain data unrelated to DNS, so basically it is about conceptional cleanliness. The problem you are describing might be fixed by a well-designed and well-implemented name constraint mechanism. X.509 has name constraints specified as of RFC 5280, but these are defunct in most implementations, making them essentially useless.
Dec
1
comment Is SSL dying? Should I buy SSL certificates for my sites any more?
@kasperd which is not going to happen all that soon - there is strong opposition within the IETF to putting application keys into DNS. There is RFC 4387, but it is not seeing notable implementations in clients as of today
Sep
24
awarded  Autobiographer
Jun
25
comment Are login “certificates” more secure than standard username + password authentication?
A private key is significantly harder to attack and steal once it is stored on a smart card and not accessible directly. Smart cards can be used as certificate / key stores in many browsers and mail applications through standardized interfaces. Also, with some banking standards like FinTS smart card support is included in applications supporting them.
Jun
18
awarded  Citizen Patrol
Apr
16
comment How are two systems able to set up a secure SSH tunnel over a public connection?
It is worth mentioning that SSH has not been using Diffie-Hellman key exchange before v2 and that TLS/SSL also not necessarily is using it but might be (and often is) configured to simply choose a random value at the client as the secret key and send it to the server after encrypting it with the server's public key. This is obviously less secure as the DH key exchange, but is often chosen over DH due to compatibility issues and the higher computational overhead of DH on the server's side.
Jun
26
answered Does a commercially available self destructing HDD (set in BIOS) exist?
Jun
26
comment Somebody bumped into me, next day my storage unit was burglarized
What kind of a security concept is this? Allowing entrance just with data off a magnetic stripe without an accompanying secret? Having the same data stored in plain and without cryptographic safeguards available through RFID? A "masked person" entering the hallway without anybody paying attention?
Mar
28
comment Would it be possible to overload a large part of the internet, and if so then how?
The troublesome fact is that you would not need all that much. The DNS amplification attack performed has an excellent yield ratio of 50x or more, so with just a 100 Mbps upstream (which is a thing a single $5/month VPS would give you) you could induce 5 Gbps of traffic on the net directed to your victim(s). See blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack
Jan
28
answered Can I determine if my computer has a key logger installed?
Jan
28
answered Reverse-engineering one-time passwords for two-factor authentication systems
Jan
26
awarded  Teacher
Jan
26
answered Can accounts still be logged onto if Password Caching is not enabled?