Dan Neely

151 reputation

bio	website	orthogonaltonormal.com
	location	Johnstown, PA
	age	31
visits	member for	1 year, 6 months
	seen	6 hours ago
stats	profile views	20

//TODO Glorious Lies

	151 reputation	bio	website	orthogonaltonormal.com	visits	member for	1 year, 6 months
5 badges		location	Johnstown, PA		seen	6 hours ago

summary answers questions tags badges favorites bounties reputation activity

66 Actions

suggestions reviews revisions comments badges posts accepts all

6h	comment	Disabling CCTV/IP Cameras For indoor use I'd expect most cameras to have IR/UV filters. General purpose cameras all have them because the sensors respond to light beyond the visible range; and not doing so result in weird color balance.
Jun 11	comment	Somebody bumped into me, next day my storage unit was burglarized @drjimbob I have tested mine as best I can without access to a high power reader. The badge readers where I work only have a 3 to 5 inch range normally. Inside of the wallet my badge fails to read both at contact distance with only the side of the wallet between the reader and the badge and with the open end touching the reader.
Jun 10	comment	Somebody bumped into me, next day my storage unit was burglarized If you're concerned about having an RFID card surreptitiously duplicated, you can buy ordinary looking wallets that have a wire mesh layer build in to block RF signals.
May 30	comment	Once VPN is unplugged can work still monitor? To clarify, are they asking for your wifi credentials, or your routers administrative account? IMO demanding the latter is as unacceptable as any other "tell me your password" demand. If configuration changes need to be made, insist they document them so you can do them yourself.
May 22	awarded	Citizen Patrol
May 21	comment	How to make a site vulnerable to SQLi? @JacobKudria language agnostic example: `querystring = "Select * FROM SomeTable WHERE SomeField = " + rawuserinput;` Then just use Bobby Table's full name as the userinput. xkcd.com/327
May 16	comment	Touch Screen Password Guessing by Fingerprint Trace @Adnan Speak for yourself. Even with common long term passwords I enter them by repeating the mnemonic I memorized in lieu of something like "ASfy#wcltp13tbrtMIM". Having to hunt/peck on an Qwertz/Azerty/Dvorak/etc keyboard would slow me down; but what I memorize isn't the positions of the keys.
May 16	comment	Touch Screen Password Guessing by Fingerprint Trace If available, a pinpad unlock screen that randomized the number layout each time would defeat a smudge attack. Where I work the badgereaders we have do this; it only takes an extra second or two to find where the numbers are this time and type the 6 digit pin. OTOH if all you have is a standard length pin an attacker could use brute force tools to break in and I suspect a scrambled layout would be a much larger impediment on an alphabetic keyboard if you were entering a password instead.
May 10	comment	Technical security issues with proactively executing a phishing campaign targeting your own users Disagree with the last paragraph. While phishers generally do use botnets, etc to send their messages you could send them from TempDomainForTheBossesReallyReallyBadIdea.com using servers you control, but not from a domain that ever should be sending that sort of message instead.
May 9	comment	Is showing your IP address in the URL a bad practice? Using an IP as a URL is bad. Not in terms of security; but from a usability standpoint. If your IP changes all your users bookmarks/links will break (especially bad for a server whose path is baked into numerous config files). It's harder for the user to remember how to get to your site if they lose their bookmark/link. If the user forgets what their bookmark is for an IP doesn't give any hint about it.
May 9	comment	Intel How Strong is Your Password page, good advice? It's better than using an identical password everywhere since it will reduce your vulnerability to automated attacks; but is next to useless if a human is targeting you directly and has access to one of your passwords created with that system.
Apr 8	comment	Man-in-the-middle Blue coat proxy ssl or what? My employer uses bluecoat both as a content filter and for DLP. They also have an SSL whitelist that allows financial/medical/govt sites to be accessed without being snooped (caveat; I've never actually visited my banks from work so I don't have any info on how extensive the list is).
Apr 8	comment	Is there additional security value in using passwords with words or phrases in non-English languages? Appropriate to this question too: i.stack.imgur.com/AehwB.jpg
Mar 27	comment	Email instead of username `"since it is supposed to be a valid domain name, hence limited to a subset of ASCII"` Domain registration using non-latin scripts has been available since 2011; unless there're additional restrictions on email addresses your advice is no longer correct. Even if there still is an ascii restriction today assuming it will always be present is IMO dangerous.
Mar 20	comment	How is an ATM secure? @gerrit breaking open the money box is easier said than done. A lot of would be thieves manage to tear the ATM free from its anchor but then fail to get any money out afterwards.
Mar 6	comment	Is it possible to locate Tor/proxy users? Spam is getting on my nerves +1 for pre display moderation; but there's no need to run posts from long time users through it. Unless you have a high volume site, just requiring a few legit posts before allowing posts to be displayed without moderation will cripple the trouble maker since there're only so many legit messages he could post to promote his newest set of accounts. Depending on how lazy the person is even first post moderation might make the abuse too much work to be fun.
Mar 6	comment	What is the most security benefit of a clean desk policy? That Orange anecdote is even more amusing if you've read the section of Surely You're Joking Mr Feynman where he describes the flawed document storage systems used in the project: Initially locking filing cabinets with open backs; later combination lock safes which to be more user friendly only required trying 20 of the 100 values on the dial in an exhaustive search and for which 2 of the 3 values could be found by twiddling with the dial while it was open.
Mar 6	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field @AnuragKalia so only enable it in the event of a password policy being in place.
Mar 5	comment	Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field too bad we can't convince MS to implement this for the windows login dialog.
Feb 28	comment	I managed to capture a botnet control host, what do I do with it? @SeanCheshire because major players in the security industry stop at sending "You need to clean your computer" messages instead of doing it remotely for them I believe that there are impediments standing in the way of being able to do so legally; and that your suggestion would open Shadur to being arrested or dragged into court.