5,647 reputation
522
bio website ralstonrats.co.uk
location Scotland, United Kingdom
age
visits member for 3 years, 4 months
seen Apr 11 at 22:19

Apr
11
comment What causes an Operating System to become Corrupted?
Question appears to be off topic. The only bit relevant to Security is that this is most likely a pirate copy.
Apr
11
comment User experience monitoring
It's not new. Its connection with security is more about marketing than functionality.
Apr
10
comment Harden a server against mass SSH DoS attacks
(I wonder if I should point out that the bear didn't mention syn cokies?)
Apr
9
comment How can I know when a certificate was created?
I was under the impression that Heartbleed is a code issue, not a certificate issue / not mitigated by changing the certificate. Perhaps you could supply a reference to support your assumption?
Apr
9
comment What is the point of certification authorities that are not trusted by browsers (=trusted by Root CAs)?
wiki.cacert.org/InclusionStatus
Apr
8
comment Fixing large number of SQLi, XSS, RFI/LFI in a PHP application
Yes, I may have traded clarity for impact there. By sanitize I mean transform the data into a suitable representation for the medium it is being sent to (html, url, database, email....).
Apr
8
answered Fixing large number of SQLi, XSS, RFI/LFI in a PHP application
Apr
4
comment Server side SSH keys compromised
I agree with your analysis of the direct effects of the compromise (no they can't decode the traffic) - further such a scenario would be possible if someone gets hold of a backup. However if the server is compromised then there are lots of other bad things the cracker could do. And I would still consider it good practice to change the key pairs.
Apr
2
comment Why do banking websites always log you out after inactivity?
using a timeout makes it less likely that another user on the same device can access the session - this is not a session hijacking attack, nor is it session fixation.
Apr
2
comment Accepting an untrusted security certificate?
@Lucas: is this in reply to Stephen's comment? If so, "not entering any data" does not prevent a spoofed site from carrying out a MITM attack against the real site (session hijacking, capturing credentials including 'remember me') and using the browser as an anonymous proxy for other nefarious activities
Apr
1
comment running firefox as unprivileged user on Linux
users.stat.umn.edu/~geyer/secure.html, sans.org/reading-room/whitepapers/unix/… Note that you shouldn't use MIT-MAGIC-COOKIE-1 across a network (use ssh) or on a shared sysetm (use XDM-AUTHORIZATION-1)
Apr
1
answered can a x.509 certificate alone be used for user authentication?
Mar
31
answered running firefox as unprivileged user on Linux
Mar
27
answered SSL is Extended Validation more secure?
Mar
25
comment Random salt - necessary for a single user?
If it's really "one user per database" then why are you implementing your own authentication system and not using the authentication functionality already in the DBMS?
Mar
20
answered What needs to be focused on when hardening a LAMP stack?
Mar
20
comment What needs to be focused on when hardening a LAMP stack?
Both the links here point to wikipedia - did you mean to include a link to the NSA stuff?
Mar
19
comment How to securely share key between two remote devices?
If that's the only reason for your requirement to implement symmetric encryption then use an AES based cipher suite in TLS/SSL and don't bother with the offline encrpyion.
Mar
19
comment How to securely share key between two remote devices?
That doesn't really answer my question. TLS already implements a secure symmetric key exchange mechanism. Is there a reason for wanting the server to hold both the key and the encrypted data as opposed to just the unencrypted data?
Mar
19
comment Is it safe to store the reset password token in php session
You'd have to be offering a REALLY useful service to convince me to type 50 random characters every time I forgot my password.