schroeder

7,574 reputation

11037

bio	website
	location	Canada
	age
visits	member for	1 year, 5 months
	seen	10 hours ago
stats	profile views	342

Canadian insurance company Security Manager.

	7,574 reputation	bio	website		visits	member for	1 year, 5 months
11037 badges		location	Canada		seen	10 hours ago

summary answers questions tags badges favorites bounties reputation activity

924 Actions

suggestions reviews revisions comments badges posts accepts all

Dec 19	comment	Bruteforce vs Denial of Service whitelist the admin's IPs?
Dec 19	comment	Bruteforce vs Denial of Service You can effectively DoS the account the same way. I love the increasing time out, but for static admin accounts, you can run in to the same problems as when you lock out the account.
Dec 19	comment	Bruteforce vs Denial of Service 'CAPTCHA' is the word you are looking for.
Dec 19	comment	OpenSSH default/preferred ciphers, hash, etc for SSH2 I feel like saying: "it is all accessible in the man pages if you do a ctrl-f". It took me a minute to do the search and with that being the case, I would have no reason to cache that data in my memory. Defaults between programs are bound to be different because the sshd has to accept connections from different kinds of clients. If, on the other hand, you want to know which is the most secure configuration, then your question needs to be changed.
Dec 19	comment	How to know what's the type of an attack and from whom is sent? My question stands: how do you know that it is an attack and not a problem with the server itself? What is your evidence of an attack besides the server locking up? Have you found/configured the logs yet? Data, data, data ...
Dec 19	comment	How should I audit and monitor shared TCP ports in Windows? netstat on the server to determine host IP and source port along with the binary/PID serving the request?
Dec 19	comment	What are the basic certification course for beginners? A+ is not security. How does this apply to the OP's question?
Dec 19	comment	How can I use certificates to secure my webservices? What is available to javascript? I have not seen this implementation in a website. Won't each of your clients have to install the client certificate on their end in a secure way to make this happen?
Dec 19	answered	OpenSSH default/preferred ciphers, hash, etc for SSH2
Dec 19	answered	How to know what's the type of an attack and from whom is sent?
Dec 19	revised	How to know what's the type of an attack and from whom is sent? tags, cleaning text
Dec 19	comment	How to know what's the type of an attack and from whom is sent? How do you know that it is an attack and not a software or OS bug?
Dec 18	comment	How to spoof an ATM transaction? Someone edited the video tape?
Dec 18	answered	Access via http to other protocols and ports!
Dec 18	comment	Is this a reasonable approach to “generating” passwords? @evgeni if you use the same prefix/suffix for everything, like your Playstation account, and your Playstation account details are leaked and cracked, then it will be trivial to determine that "foosonybar112" is a scheme.
Dec 18	comment	Is this a reasonable approach to “generating” passwords? While I do like the password manager idea, the suffix/prefix approach can work very well IF all passwords are changed regularly. Leaving all those passwords out there unmodified for a long time leaves you exposed to having your scheme deciphered.
Dec 18	comment	Is my developer's home-brew password security right or wrong, and why? Dave might have had a point if he ended up with a better and more secure approach. He did not. The reason we use published algorithms is so that we all benefit from the collective wisdom of others and don't have to rely on our personal and evolving understanding of a concept.
Dec 18	comment	Auditing Existing Socket Connection Each computer can have a firewall and (H)IDS, and those things listen to all traffic. So, a web server can be listening to port 80 and at the same time have firewall/IDS inspecting port 80 traffic, all on the same computer. The trick is that the traffic is not 'destined' for the firewall/IDS.
Dec 17	answered	Auditing Existing Socket Connection
Dec 17	answered	Is there a linux laptop equivalent to dsploit for android?