14,609 reputation
12463
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 11 months
seen 2 hours ago

Security Architect

Owner of: SelfPhish.com


Jul
23
comment Someone borrowed my phone and Im scared its hacked
I have NO clue how this could possibly be an IT Security question.
Jul
22
comment Sign contents of entire computer?
You store the hash outside of the computer (email?). Signing performs a hash, then applies your personal key to the hash so that a recipient knows that you are the owner of the contents and the hash. I'm not sure what you gain by adding a Digital Sig.
Jul
22
comment Sign contents of entire computer?
Would a hash work just as well? You could hash the entire contents before you are away from your computer then verify when you get back?
Jul
22
comment CLI API that requires plaintext user details
So, the data supplied by the client have to match the data stored on the server? Sounds like the same problem that password has. How is the password model not the same as your situation? Transmit hashes of the data? What about shifting to Asymmetric Keys instead?
Jul
22
comment PDF Digital Signature
Sounds more like an Adobe support question than an IT Sec question.
Jul
22
comment Security sanity check
Your development team should not be rolling their own encryption processes at all in any event, but certainly not when they don't understand PKI 101. Your recommendation should simply be to follow industry standards. You just have to prove the costs of such a scheme are no more than their proposed solution.
Jul
22
comment How to tell if my laptop is being spied on
One word: mitigation. There is no such thing as perfect security, but you can mitigate the risks.
Jul
22
comment How to tell if my laptop is being spied on
You are already doing what you need to do to determine what data is being sent from your computer: Wireshark. My guess is that you aren't sure how to derive relevancy from the data Wireshark is giving you, which is an understandable frustration. My advice is to keep working along the Wireshark path.
Jul
22
comment How to tell if my laptop is being spied on
Traffic to *.nl and *.ch are perfectly valid if you live in those countries...
Jul
22
comment How to tell if my laptop is being spied on
This question is all over the map. The technical aspects are a distraction from the core question, which seems to be "How can one know they have privacy?" That question has been answered in many ways here on this site. In short, you can't prove a negative (no one has seen my communication), but you can monitor the positive (what I am leaking).
Jul
22
comment Security sanity check
According to the design, the client needs to check on the server's public key for the private exchange. How is that different than HTTPS? Unless they were hoping that by encrypting the public key (?!) the client wouldn't need to check with the CA ...
Jul
21
comment How does Network Address Translation (NAT) increase firewall effectiveness
this looks like a homework question ...
Jul
21
comment Using Free AV to meet PCI Requirement 5
Along with Tim's answer, you might have to cobble together a compliant setup with free AV, but it should be possible, with the right software.
Jul
21
comment Using Free AV to meet PCI Requirement 5
Central logging is a good point. You might be able to rig something up with shipping logs to a collector.
Jul
14
comment This protocol is vulnerable, but why?
I can see that Bob doesn't identify himself, Alice identifies herself and communicates the key (though hashed) to an unidentified party, who then sends it back. If Alice was communicating with Malory, Mal could spoof Bob.
Jul
14
comment What are the benefits of IP Whitelisting?
For instance, the number of probes dropped by 90% once I whitelisted by geo-ip. There is more to whitelisting than 'hiding'.
Jul
14
comment (How) Can outsiders discover the pages that are being hosted on my server?
And just like passwords, paths can be brute-forced. Crawlers use dictionary lists to try common directory names and try to map out an entire website, even if there are no links to those locations.
Jul
14
comment Is it possible to track a missing brand new phone?
@Gilles The OP's question is how to track a phone that the OP has never had his hands on. The most that can be done is for the police to coordinate with telco's to retrieve stolen merchandise.
Jul
14
comment Order of authentication and authorization
You were authenticated as you, but not authorized to SU to that particular account. Right? You would rather be authenticated first and allow brute force attempts to log in as that user?
Jul
14
comment Is it possible to track a missing brand new phone?
Why track it? Work with the vendor to replace the missing merchandise. This is a shipping problem, not a security issue.