12,036 reputation
11651
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 7 months
seen 17 hours ago

Canadian insurance company Security Manager.

Owner of: SelfPhish.com


Jul
23
comment Can I safely use my own statistics to assess password strength on number of times a password is used?
So, a message like, "That password has already been used by many other users of this site. Please choose another." ? Great. Now I have a confirmed password used by N number of users. all I have to do is brute-force account names, which are not private.
Jul
23
comment Can not open my yahoo email. The connection was interrupted
How is this an IT Security question?
Jul
23
reviewed Close Get the browser history without using a browser
Jul
23
reviewed Reopen Useful object for a professional pentester
Jul
23
comment Useful object for a professional pentester
Pentesting requires that you test an ever-changing field of technology. By definition, any tool to do that will become obsolete. I truly understand your Grandmother's desire, but there is no "pen set" for pentesters like there was for college grads in yesteryear.
Jul
23
comment Open list of adult websites for child internet
DNS services provide this for free. Keeping up with the infinite list is too resource intensive to maintain in a text file.
Jul
23
comment Someone borrowed my phone and Im scared its hacked
HE WAS TOO SHY TO ASK FOR YOUR NUMBER!
Jul
23
comment Someone borrowed my phone and Im scared its hacked
I have NO clue how this could possibly be an IT Security question.
Jul
22
comment Sign contents of entire computer?
You store the hash outside of the computer (email?). Signing performs a hash, then applies your personal key to the hash so that a recipient knows that you are the owner of the contents and the hash. I'm not sure what you gain by adding a Digital Sig.
Jul
22
comment Sign contents of entire computer?
Would a hash work just as well? You could hash the entire contents before you are away from your computer then verify when you get back?
Jul
22
comment CLI API that requires plaintext user details
So, the data supplied by the client have to match the data stored on the server? Sounds like the same problem that password has. How is the password model not the same as your situation? Transmit hashes of the data? What about shifting to Asymmetric Keys instead?
Jul
22
reviewed No Action Needed Saving passwords decryptable for later usage
Jul
22
revised Broadband security question
wording, spacing
Jul
22
comment PDF Digital Signature
Sounds more like an Adobe support question than an IT Sec question.
Jul
22
reviewed Reviewed PDF Digital Signature
Jul
22
comment Security sanity check
Your development team should not be rolling their own encryption processes at all in any event, but certainly not when they don't understand PKI 101. Your recommendation should simply be to follow industry standards. You just have to prove the costs of such a scheme are no more than their proposed solution.
Jul
22
comment How to tell if my laptop is being spied on
One word: mitigation. There is no such thing as perfect security, but you can mitigate the risks.
Jul
22
answered How to tell if my laptop is being spied on
Jul
22
comment How to tell if my laptop is being spied on
You are already doing what you need to do to determine what data is being sent from your computer: Wireshark. My guess is that you aren't sure how to derive relevancy from the data Wireshark is giving you, which is an understandable frustration. My advice is to keep working along the Wireshark path.
Jul
22
comment How to tell if my laptop is being spied on
Traffic to *.nl and *.ch are perfectly valid if you live in those countries...