21,955 reputation
44285
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 8 months
seen 7 hours ago

Security Architect


Jun
9
comment Ensure that a file can only be decrypted after a specific condition is not present
this is a duplicate of a closed question: security.stackexchange.com/questions/91063/…
Jun
9
reviewed Approve How can I know that developers will be ethical and not record my password in plaintext
Jun
9
comment DDoS attacks targeting Android
Perhaps it would help if you explained what you know about DDoS. I'm not sure that any single device could have protection against DDoS.
Jun
9
comment Is it necessary to use SSL for MySQL?
Do users need to log in? Would it be "really bad" if someone changed the data displayed to end users mid-transmission? Is the SSL only for the connection between Apache and MySQL or between Apache and end users?
Jun
9
revised Unidentified Filemount in Ubuntu
added 2 characters in body
Jun
9
reviewed Reviewed PCI DSS 3.0 and card swipe terminals for our merchants
Jun
9
reviewed No Action Needed Are password reset links that don't expire a security risk?
Jun
9
reviewed No Action Needed Is there a PKCS certificate format that signs ASCII data?
Jun
9
reviewed No Action Needed Would disabling resumption/renegotiation mitigate the triple handshake issue?
Jun
8
comment Are there any meta-formats for crypto?
The OP dismissed CMS in another answer. Also, this answer is very light on content. You might need to flesh this out.
Jun
8
comment How can I recover my encrypted data from a Sandisk Secure Access
Unfortunately, we are not tech support. If you recreated your passwords, then you likely wiped the existing files.
Jun
8
reviewed Close Good Free Scanner for Large Web Applications
Jun
8
comment Security implications of static IP?
For instance, if a scanning bot is looking for weaknesses, finds your vulnerable port and enters you into a registry, then your record in that registry will continue to be valid. It might not matter in your situation, but the argument you state has more context to it.
Jun
8
reviewed Close Why OpenID Connect instead OAuth 2.0?
Jun
8
comment Security implications of static IP?
I think the argument is better stated, "if an attacker finds a weakness, they can always return to your vulnerable port". That threat is up to you to accept or not.
Jun
8
revised Privacy and VPN - does employer's VPN still log activity when I am connected by wifi?
added 83 characters in body
Jun
6
comment Should cookies expire?
Do some searches for "cookie stealing" and take a look at the old attack "firesheep". Just remember the difference between "session timeout" and "cookie expiry".
Jun
6
comment Data security is not perfectly possible, laws exist but no one uses them. What is missing on international level?
You still haven't asked a cohesive question. "What to do" about what? What about regulatory standards like PCI-DSS, HIPAA, etc.?
Jun
6
reviewed Close Perform SSL MITM -> Decrypt packet -> Modify packet -> Encrypt packet -> Send it
Jun
6
comment Perform SSL MITM -> Decrypt packet -> Modify packet -> Encrypt packet -> Send it
This is a very broad question, and more of a programming issue. You need to create a service that does all this. Take a look at a web proxy like squid for a service that does what you're looking for.