Reputation
63,379
Next tag badge:
1520/400 score
75/80 answers
Badges
17 155 253
Impact
~2.8m people reached

Oct
3
comment Calculating complex password entropy?
100% agree that the only secure password is the one that doesn't involve a human. Keepass, Lastpass, 1Password, etc. are the way to go.
Oct
3
answered What about combining pkdf2 with scrypt?
Oct
3
comment Nexus 7 (Or any other good android tablets) For pen testing
Why would you pentest from a tablet, rather than a netbook or laptop that can easily run Linux? It just seems like an exercise in futility.
Oct
3
comment How to back up encrypted data over a VPN connection? The encrypted container, the data within or encrypted individual files?
It shouldn't make a difference as to whether the container is mounted or unmounted when you make the backup. The resulting backup should be in exactly the same state as the real original.
Oct
3
awarded  Nice Answer
Oct
3
comment Vulnerability scoring systems
@lucho The environmental metrics are designed to store the results of your fiscal impact assessment. You don't need to skip them, you just need to do the financial assessment. If that's outside the scope of your analysis, then you can skip them.
Oct
3
comment Vulnerability scoring systems
@lucho If you're presenting projected financial losses to a client, CVSS isn't what you want. It's purely for expressing technical impact, from which you can extrapolate potential information losses, and finally project costs. Extrapolation of losses is done by identifying what you're protecting, and how those assets might be affected by the issues you document and score with CVSS. From that, you have to work out what the maximum fiscal impact is of having those information assets compromised. CVSS doesn't do that - it's a separate task.
Oct
3
comment Vulnerability scoring systems
Agreed. CVE is for technical impact analysis, not financial. You need your legal and financial guys to help you out with a risk analysis.
Oct
3
comment What is the key when facial recognition is used as a password?
Android protected storage requires a key to be provided, but I'm unaware of any restrictions on authentication providers. The key may well be provided statically from the authentication frontend, after the facial recognition provider gives it the go-ahead.
Oct
3
comment Vulnerability scoring systems
@lucho CDP is designed to express the maximum potential fiscal loss, based on your current client list. As such, assume that all of your clients get affected by the issue (where applicable) - how much will it cost you?
Oct
3
answered How to back up encrypted data over a VPN connection? The encrypted container, the data within or encrypted individual files?
Oct
3
revised What is the key when facial recognition is used as a password?
Fixed link, added tags
Oct
3
comment What is the key when facial recognition is used as a password?
-1. The credential manager on Windows requires that authentication providers supply a user key, so that the SAM can be decrypted. As such, facial recognition and fingerprint devices are still required to use some sort of key mechanism, e.g. fuzzy key.
Oct
3
comment What are the security implications of phone based keyless entry systems?
What happens if the power goes out, or the wifi router crashes?
Oct
2
answered x.509 CRLs: next update?
Oct
2
answered Why would a virus writer bother to check to see if a machine is infected before infecting it?
Oct
2
answered Can a VPN decrypt my SSL traffic?
Oct
2
comment Does SQL have any inherant weaknesses?
i.qkme.me/3r5wug.jpg
Oct
2
answered How can I decode a message that was encrypted with a one-time pad?
Oct
2
comment Digital Signature and Verification?
@Ninefingers That's fair - it's why I qualified it as "can be", but I should've been clearer.