12,275 reputation
11654
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 8 months
seen 2 hours ago

Canadian insurance company Security Manager.

Owner of: SelfPhish.com


1h
comment Plausible deniability regarding KeepassX files
So, this boils down to a question of how to pass off a 2nd file as the original and how to maintain the 2nd file as the original changes?
17h
comment What are some good tips/resources/guidelines for a highschooler trying to get into IT?
Also, are you looking to get into IT or IT Security? Both are VERY wide and diverse fields. In order for this question to be answerable, you would have to narrow it down considerably.
17h
comment What are some good tips/resources/guidelines for a highschooler trying to get into IT?
There have been multiple variants of this question on this site. Do any of those provide direction?
18h
comment Plausible deniability regarding KeepassX files
why do you need deniability for a password file?
18h
comment Plausible deniability regarding KeepassX files
Except that you announced to the world that you have those files by posting on this site? :)
21h
comment Sample test cases for all owasp top 10 vulnerabilities
you're looking for test cases to run against your own site? There are numerous testing suites that run a battery of tests for most of the OWASP top 10.
1d
comment Building a DoS and DDoS Mitigation System from scratch
re: "distributed system" you missed my point. If the last-mile ISPs receive data from the DDoS target routers, which identifies the characteristics of the attack, then the last-mile nodes can handle the 'bad' traffic before it chokes the backbone. This is the basic premise that my development team was working on. If the attack changes sources, the network is already on alert for the attack signature and can respond faster if new sources come online. Small code-base. Small CPU-overhead. Low cost. This is one way of tackling the problem.
1d
comment Building a DoS and DDoS Mitigation System from scratch
I worked on a development team that was creating anti-DDoS systems. My point is that, yes, it is a big topic, and yes, you have limited space to address the OP's question, but you didn't use your space to talk about the relevant points. Your answer is more of a dismissal and talking about purchasing, not designing a system.
1d
comment Building a DoS and DDoS Mitigation System from scratch
I'm not sure that this is a helpful answer at all, in any respect. The OP asks how to design from scratch, and you assume he is buying off the rack. You also have a ton of assumptions and have applied random costs. What about a distributed system across all ISPs? You need only identify a single stream of offending traffic and coordinate the info across the nodes. You cut the attack off at the source, instead of the destination. Low cost, low bandwidth, and responsive to changes in the attack.
Aug
14
comment BYOD - Confirming that Devices are Approved
Product recommendations go stale, but since you asked: Netclarity.
Aug
14
comment Is it a bad idea for an information holder to e-mail a user their password?
If a user has 'forgotten' about the site, then offer a password reset option. Doing so means that you do not have to store the user's password in a way that breaks standard password protocols.
Aug
14
comment What are some considerations before moving personal data to Google Drive?
It is an answer, and a viable one, it is just very, very short.
Aug
14
comment How secure is KolibriOS?
"How secure is x" is not really answerable. What do you want it to be secure from?
Aug
13
comment Confidentiality of file hashes
You say that hashes are not reversible, but wondering if hashes are reversible? You seem to have the answer you are looking for.
Aug
13
comment Would it be illegal if one downloaded the entire internet?
Legal questions are off-topic here, and there is nothing in this question about IT Security. This is a philosophical thought exercise.
Aug
13
comment BYOD - Confirming that Devices are Approved
Why do you want to approve the device along with the user? What problem does that control address? If the user can walk out with the device, (because BYOD), then what is mitigated by limiting what is used?
Aug
13
comment BYOD - Confirming that Devices are Approved
You would seem to require an agent-based solution. You install the agent on the approved devices and only those can connect.
Aug
13
comment Can we trust antivirus software?
Any software could be considered to be a backdoor if they contain certain vulnerabilities. You need to consider the reputation of the vendor and the attack surface of your assets.
Aug
13
comment Why is ettercap targetting the whole network?
You can make your own answer and mark it as such in order to close this question.
Aug
12
comment How can one recover the plaintext from the last part of an MD5 hash?
You don't have the whole hash?