Reputation
7,398
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
10 38
Newest
 Revival
Impact
~561k people reached

10h
answered Making a file immutable (against kernel exploits)
19h
comment Fraud detection to avoid fake users
@user455138: Augur (and 41st Parameter, and Threatmetrix) only do 2 things that fingerprint.js doesn't. They have a database of identities linked to accounts at different providers and they also use clock skew to differentiate between appliance type devices. Device identification is all about trading off specificity against volatility - since clock skew is highly volatile, it needs to be rounded off massively to give consistent results within a fingerprint (or kept separate from the fingerprint and fuzzy matching used).
19h
comment Fraud detection to avoid fake users
@Stephane: clearly you know more about this than myself, 41st Parameter (now Experian), Threatmetrix, Blue Cava, EFF and Augur. Perhaps you would like to volunteer a solution to the problem?
1d
comment Fraud detection to avoid fake users
I wouldn't describe $500/month as incredibly expensive, though it may be in the context of your project. It was your suggestion to use fingerprinting. Evercookies are not completely foolproof, and pose legal issues in europe, otoh its relatively easy to detect and block access for someone going out of their way to defeat active fingerprinting. BTW, augur is using fairly ordinary active fingerprinting, there are a few open source projects offering comparable functionality without the cloud database x-ref.
1d
comment Fraud detection to avoid fake users
Stephane, you really should do some research before making comments like this. Go read the Panopticlick paper (they're not using ASN numbers, but they do use timezone which is even less effective). While you're at it, you might try visiting the site a few times with "private browsing" enabled - the whole point of browser fingerprinting is that it bypasses the mechanisms in private browsing to get a consistent identifier for your device.
1d
answered Fraud detection to avoid fake users
Feb
9
reviewed Reviewed How to enable Windows firewall to log attempts to connect to closed (not listenting) ports?
Feb
9
reviewed Approve How do you deal with massive port scans?
Feb
8
awarded  Revival
Feb
8
comment How much can we trust open source implementations of crypto (security) libraries?
"hopefully reviewed by some security experts" - LOL
Feb
8
answered Safest way to access data from an SQL server
Feb
8
comment What is is the best way to create virus signature database?
You're not going to be able to do stream matching a hash database. So your "anti-virus" software will also need a whole load of container format parsers (and it won't be very efficient). Given that there are good, efficient open source and commercial AV tools available, what are you trying to achieve with your proposed products?
Feb
6
comment How does one securely create a MySQL database and user via the command line?
@Neil: man bash, /readline
Feb
6
comment How does one securely create a MySQL database and user via the command line?
You're making an appointment which uses a database and you've only got bash to interact with it, and only have a problem with the password for the initial creation of the database????!!!!
Feb
6
comment How can you prevent email addresses from being harvested from a registration form?
You've really answered your questions yourself. As a service provider you can make it harder to identify valid email addresses, but addresses are (usually) not secrets. I've not checked recently, but UBE target lists come in under a penny an address. Typing random combinations into a website is not a very cost effective approach. OTOH a site which leaks information and has unsavoury associations would be a potential tool in targeted attacks
Feb
4
answered sharing private key sTunnel
Feb
4
comment What can go wrong when allowing file uploads on a web server?
Copyright, privacy and other legal issues relating to disclosure of private information. Liability for publishing indecent or libelous content.
Feb
4
comment How trustworthy is Firefox?
Is that where the browser instance resides? Where the organization developing the product resides? Where the data resides?
Feb
3
comment plain FTP (no encryption)
may affect the speed of the file transfer - would it be so hard to test? Most ssh servers/clients can compress data - not true of FTP.
Feb
3
comment How to (further) ensure SSH security?
+1 for a good answer, but "renders fail2ban ineffective" is wrong. Certainly enforcing keypairs is effective against the crude ssh worms circulating the internet, but blocking an IP address (not just port) and logging the activity when it is misbehaving slows down a targeted attack a lot.