13,465 reputation
11959
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 10 months
seen 15 hours ago

Canadian insurance company Security Manager.

Owner of: SelfPhish.com


Jun
20
comment Is it safe to tell your users what kind of hashing algorithm you use?
Aside from technical issues, I'd be concerned about potential liabilities. If you proclaim to use a specific technology for security, and then it is found that you did not use it in an instance that resulted in an event, your customers have a specific liability claim. That's why in general, businesses say what they will do, not how they will do it, unless the process is key.
Jun
20
comment Is providing a website password over the phone any less secure than other identifying information?
@Clockwork-Muse I agree with all of your points. It seemed like the rep's computer chose the random letters. It required the language to be one of the official languages of the country of the bank, but that is not unreasonable. The guidance when created the Q&A was to not make it public information. In my personal experience, the general public does not have a problem with character indexes of words in their native language. I agree with all the weaknesses, but as a customer, I thought it was an effective scheme nonetheless.
Jun
19
reviewed Reviewed Is sending plain passwords over SSL as part of a password update process bad?
Jun
19
revised Is sending plain passwords over SSL as part of a password update process bad?
grammar
Jun
19
reviewed Reject suggested edit on Apple FileVault — would Apple build a backdoor?
Jun
19
comment Is providing a website password over the phone any less secure than other identifying information?
A bank I used had a typical 'make your own security question and answer' scheme, but what I liked about it was that instead of asking for the answer, the rep on the phone asked for 2 random letters from the answer. "What is the 2nd and 6th letter of the answer?" Simple enough, non-factual, and no 'overhearing' vulnerability. It was also only used when calling in.
Jun
19
reviewed No Action Needed Can my GSM network operator figure out the name of the Wi-Fi access point I am connected to?
Jun
19
comment Are there any exploits in Movable Type that allow the attacker to delete the movable type files?
Your Moveable Type version is old. I would suggest upgrading to version 6 as a means of preventing it from happening again?
Jun
19
comment Wifi deauth attack - Difference between Aireplay and MDK3
I'm not sure that this answers the question. The OP is looking for specific help, not an overview of the 2 programs.
Jun
19
revised Wifi deauth attack - Difference between Aireplay and MDK3
clarity
Jun
19
comment How did the Tweetdeck XSS Vulnerability work
and this: readwrite.com/2014/06/11/…
Jun
19
comment How did the Tweetdeck XSS Vulnerability work
Google searches produced the following example: blog.sucuri.net/2014/06/…
Jun
19
revised How did the Tweetdeck XSS Vulnerability work
formatting
Jun
19
revised Diffie-Hellman certificate verify message
formatting
Jun
19
reviewed Close In addition to using strong hash algorithms, what is a good “password requirement”?
Jun
19
answered is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?
Jun
19
comment is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?
It would be helpful to know the versions of Windows and the basic AD configuration.
Jun
19
revised Wifi deauth attack - Difference between Aireplay and MDK3
link to documentation
Jun
19
reviewed No Action Needed Wifi deauth attack - Difference between Aireplay and MDK3
Jun
19
comment Can my GSM network operator figure out the name of the Wi-Fi access point I am connected to?
This doesn't answer the basic question: is it normal for this data to be communicated? Can a phone be hacked to transmit data, sure, but that isn't what the OP asked.