Reputation
63,240
Next tag badge:
1507/400 score
75/80 answers
Badges
17 155 252
Newest
 Nice Answer
Impact
~2.8m people reached

Jun
29
comment DDOS Server Attacks & Domain Names
Assuming you have control over your NS records (e.g. in your domain provider's control panel), you could just use CloudFlare's free DDoS protection.
Jun
18
comment Is it any more or less secure to delete all my cookies vs. individually logging out?
To be clear: deleting your cookies alone (or first) is a bad idea, as the session might still persist on the server. Best option is to log out, then delete any remaining cookies.
Jun
15
comment How to devise a security policy?
@JohnnyUtahh Thanks for the heads up. Fixed the links.
Jun
15
comment How to devise a security policy?
@JohnnyUtahh There's certainly overlap on the Venn diagram, but they're not the same. A usage policy governs how employees should conduct themselves when using IT systems (e.g. no naughty images via work internet access). A security policy also has elements of conduct (e.g. no dodgy sites, cracked software) but is usually much larger in scope, such as giving procedures and contact information for security incidents, and may be broader in scope than just IT (e.g. handling of physical media, documents, etc.)
Jun
15
comment What is the purpose of using different DNS server in nmap?
@biziclop In that particular case I'd be using dig rather than nmap, but you are correct that it can be done that way.
Jun
12
comment How is Gmail susceptible to brute-force attacks?
"so if it didn’t leak from some other site" is the key part here. It's very likely she re-used her password elsewhere and it got compromised.
Jun
10
comment How to look for steganography in a picture
strings.
Jun
10
comment How to look for steganography in a picture
Have you tried strings over the image?
Jun
10
comment Is it secure not to have csrf protection in login forms?
@Aatif It's also a form of session donation. The terminology is largely moot anyway - the point is the actual attack and its impact.
Jun
10
comment Is it secure not to have csrf protection in login forms?
@AviD Session fixation issues can be exploited to produce a session donation in some cases, but usually they're separate. You're correct about forcing them to log in with your creds though.
Jun
10
comment Is it secure not to have csrf protection in login forms?
@AviD Not quite the same. Session fixation is where you set a session cookie in their browser before they log, but the application doesn't change the session ID on login, so you then know the session ID and can hijack their session. This gives you full access to their account. Session donation attacks involve using CSRF to log them into your account, not theirs, without them realising.
Jun
9
comment Potential collision with hash password
@Kruncho I'm not sure what you're asking there. If you're referring to why they're used in Linux or Windows by default, I don't know the answer. It's probably something to do with a lack of NIST approval, or just that it's always been done in a particular way. Microsoft provides PBKDF2 in the .NET Framework though (via the Rfc2898DeriveBytes class) and bcrypt is available as a command-line tool on Linux. I'm also pretty sure that some Linuxes do support bcrypt hashes for logon (in /etc/shadow), either natively or with additional PAM modules.
Jun
5
comment Can DUKPT BDK be 192 bits?
Keep in mind that 3DES is vulnerable to a meet-in-the-middle attack, which reduces the time complexity of 112-bit 3DES-EDE key option 2 to 2^57 operations with a storage requirement of 2^56 64-bit blocks (512 petabytes). This is considered feasible, since a large number of organisations have SANs and other storage clusters of or exceeding this size. The same attack also applies to 3DES-EDE with a 168-bit key (i.e. three independent 56-bit keys) with a time complexity of 2^112 and the same 512PB storage cost.
May
28
comment What is the “Moose” worm and how can I protect myself from it?
Keep in mind that the "ShieldsUP service from GRC.com" is a product created by Steve Gibson, who has demonstrated a fantastic lack of understanding of network technologies. He's a salesman and pundit, not a security expert. There are numerous reports that ShieldsUP doesn't actually properly scan ports, and may return both false positives and false negatives.
May
27
comment Is this way of encoding cryptographic hashes safe?
@apsillers Ah, I see what you're saying - there's a potential for collision between a pair of 3-char and 2-char base62 units where the encoding could be 3-then-2 or 2-then-3.
May
27
comment Is this way of encoding cryptographic hashes safe?
That would only be true if ONLY two base62 characters were put into the string regardless of what the three base16 characters encode to. I don't think that's the case though - I think all 3 characters are added and the string gets longer.
May
27
comment Is this way of encoding cryptographic hashes safe?
@apsillers My understanding is that they're not truncating each block, but rather concatenating all of that data together, such that there's no loss of information even if you can't trivially identify which ones were 3-char and which ones were 2-char.
May
27
comment Is it safe to publish some internal IP of my company?
@justarandomguy Right, but you've posted this on Meta Sec.SE, not Sec.SE.
May
27
comment Can attackers get anything with DoS attacks except crashing the service?
@RoryAlsop Yikes. Sounds ideal!
May
27
comment Why Adobe is recommending McAfee security scan during flash player installation?
@MilchePatern You're talking about the general security of Flash, which is a totally different matter to this specific affiliate marketing campaign. Also, Steve Jobs was a businessman and marketing director, not an engineer or coder - his thoughts on the security of Flash are irrelevant to this particular topic. Even if we were to entertain his opinions, they mostly rely upon the complaint that Flash is proprietary, which again has little bearing on the actual security of the product.