5,947 reputation
623
bio website ralstonrats.co.uk
location Scotland, United Kingdom
age
visits member for 3 years, 9 months
seen 5 hours ago

Sep
12
comment Tell people that I can encrypt emails
I disagree that putting your fingerprint in an email is a good idea - it encourages people to think that a fingerprint delivered in this way should be trusted.
Aug
29
comment SQL injection filter evasion
As you say dynamic SQL is a problem - it makes a massive performance difference to QBE if you build a custom query string. The key point is that blacklisting is always a poor solution - but whitelisting can only ever deal with a finite set of possibilities. Transforming an input to guarantee it's isolation (escaping) is a valid approach but requires a certain amount of discipline.
Aug
28
comment SQL injection filter evasion
Agree mostly with Clockwork-Muse, bu parameterized queries are just one solution. If you ave to deal with text at all, then checking for most of the SQL keywords is a better approach - but no substitute for proper isolation of data from SQL code.
Aug
18
comment Linux file information leakage
(and don't forget about backup files - zip, tar, cpio etc)
Aug
12
answered Permissions security scenarios for a web server
Aug
11
comment how to protect my linux pc from wifi sniffing
@Steve DL: read my post again. If the VPN end point is controlled by the person you're trying to hide information from then it is not fit for purpose. If the sniffer cannot access the end points then won't have direct access to the content of the packets however they will be see that the packets exist and the MAC addresses - and if they can see an unencrypted upstream then they can easily establish a correlation between the remote end point on the unencrypted network and the MAC address within the VPN.
Aug
1
answered What methods can be used to verify identity against a database?
Aug
1
comment Is a Windows AD credential combined with AD group membership 2 factor authentication?
I believe that BASEL II considers 2 passwords to be 2-factor authentication (password and "secret answer"). A key question is then whether you need two-factor authentication for the network or for the services running on the network - in the later case, access to the WIFI might be considered as a seperate authentication factor while a username and password for an application would be the second factor.
Jul
24
comment How do to keep programs updated
No dilemma - solution above - install a better OS :)
Jul
18
comment How can my employer be a man-in-the-middle when I connect to Gmail?
@Ben Voigt: Do you work for the NSA's PR dept?
Jul
17
comment How can my employer be a man-in-the-middle when I connect to Gmail?
It's worth noting that in many jurisdictions this might be considered a violation of a right to privacy (see article 12 of UDHR) depending on what your employer told you about what they were doing.
Jul
2
awarded  Curious
Jun
30
answered Application Security Input Validation: Validating Environment Variables and Config files
Jun
23
comment Convincing my manager to use salts
Although not strictly duplicates, a lot of the discussion has already been covered here: security.stackexchange.com/questions/8565/… and here: security.stackexchange.com/questions/18783/…
Jun
11
answered How many accounts should I have in an information system?
Jun
10
comment Anomaly detection in HTTP REFERER
Thanks, I suspect it still doesn't explain the traffic I'm seeing when the hosts apearing the referers should be be really on top of their security.
Jun
6
awarded  Taxonomist
Jun
2
comment How do you stop a hacker when their IP address is 0.0.0.0?
Given that the OP didn't see the glaring WTF in the logs, would he/she understand any specific recommendations on intervention if the reporting lpugin were returning valid data?
Jun
2
comment Force download files protected with auth headers
Patently these headers are not providing the protection you are looking for. It might be helpful if you explained what the threat you are trying to protect against is.
May
29
comment What are the security implications of 'open-source' vs. 'source-available'?
True, but with the exceptiona of a small number of multi-national companies and most states, the difference in your ability to resolve issues between closed source and source-available is trivial. Having said that, if you have the source you can easily measure the likely quality with static analysis.