network profile
| bio | website | |
|---|---|---|
| location | Virginia | |
| age | 30 | |
| visits | member for | 1 year, 7 months |
| seen | 13 hours ago | |
| stats | profile views | 5 |
|
Jun 11 |
comment |
Somebody bumped into me, next day my storage unit was burglarized Another possibility: someone installed something like an ATM skimmer, capturing the card one of the times OP accessed the storage unit. |
|
Jun 7 |
comment |
A client wants to tell me his home laptop's password. Must I push him towards a more-complex alternative? @Adnan "They can do whatever they want" includes installing a keylogger (software or hardware) to send the password to him once you type it in again. You have to trust the person fixing your laptop. |
|
May 28 |
awarded | Citizen Patrol |
|
Apr 24 |
comment |
How can I circumvent the lack of Java updates? Do you need Java in the browser? You can disable that if you don't. |
|
Apr 24 |
comment |
Does password-protecting a server's BIOS help in securing sensitive data? IP KVM often allows for BIOS access w/o physical access, which means it isn't that rare for servers. |
|
Apr 16 |
awarded | Teacher |
|
Apr 16 |
answered | What does having an internal two-tier PKI protect against? |
|
Apr 16 |
comment |
What does having an internal two-tier PKI protect against? @RyanRies Maybe there is something in a relevant standard saying you can't do that, but if not, there isn't really anything contradictory about that. If you (well, your CA) self-sign a statement that you're not to be trusted anymore, then you're not to be trusted. OTOH, if the person who stole the key signs a statement that you're not to be trusted anymore, then— you're not to be trusted anymore. Same thing. Anyone in control of the private key ought to be able to revoke it. |
|
Apr 10 |
comment |
Can I determine if my computer has a key logger installed? Further, keep in mind that a key logger need not be software. Hardware key loggers exist. |
|
Apr 10 |
comment |
Use additional “password” in Referer to hide private site? "It has to look for SYN packets arriving for port 80, and look at the payload to see that it's a valid HTTP request for the permitted URL" That's not possible. The SYN request does not have a payload. You have to actually accept the connection (respond with SYN|ACK) before the payload will come. |
|
Apr 2 |
comment |
Would it be possible to overload a large part of the internet, and if so then how? If the US counts as a large portion, it turned out that a lot of traffic ran through a single railway tunnel. Not a DDoS attack, so not an answer. |
|
Mar 19 |
comment |
Why not allow spaces in a password? Another reason to strip at least trailing space: on phone/tablet soft keyboards, its very easy to get an extra space after the username and/or password. |
|
Jan 29 |
comment |
default.php file found on the server, is this a security threat? @Polynomial that's good to know. Though I still wouldn't suggest your method, if for no other reason than you may have missed (and remain unaware of) part of the code. Much safer to do a pattern match to extract the string and call base64_decode & gzinflate yourself, skipping eval entirely. |
|
Jan 29 |
awarded | Commentator |
|
Jan 29 |
comment |
default.php file found on the server, is this a security threat? @Polynomial Thankfully, it didn't have eval(gzinflate(base64_decode("..."))); system("rm -Rf /") in one of those many layers (which it could, if the code to be run contains an exit to prevent the system from ever being reached). |
|
Dec 11 |
comment |
What are some risks of purchasing a “used” domain name @MarioAwad Not really. But it does depend on the user having visited the domain before you bought it, so its a fairly limited attack. |
|
Oct 9 |
comment |
It is safe to store photos and documents on skydrive / google cloud services? Protect your encryption keys from both disclosure and loss. E.g., if your house burns down (floods, gets robbed, etc.), and takes your encryption keys with it, your backups are worthless. |
|
Oct 2 |
comment |
Can someone steal money from my bank account if they know my IBAN and personal details? FYI, the routing number is not at all secret. You can look it up. |
|
Oct 2 |
comment |
XKCD #936: under what assumptions is 1000 guesses/second over a network plausible? With pipelining, you don't even need a roundtrip of latency. You send off a few requests without waiting, in a single TCP packet. |
|
Aug 30 |
comment |
How does changing your password every 90 days increase security? @BenVoigt During a password change, you typically prompt for both the old and new password. So, you have both available, and can check for similarity. |
