21,026 reputation
33982
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 7 months
seen 7 hours ago

Security Architect


May
19
comment Is my company VPN the same as third-party VPN providers?
That's what I'm saying - by routing your traffic through your company VPN, they will be sniffing your activity. Do you care about your company having control over your personal traffic?
May
19
comment Is my company VPN the same as third-party VPN providers?
"as secured" from what? For many companies, they do what you hope an attacker won't do to you (track your activity, SSL offloading, content filtering, DNS fiddling, etc.)
May
19
comment How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?
You need to edit your question: is it "FOR" or "OR" that is filtered?
May
19
comment Exploiting mailto links
@IonicăBizău perhaps you need to define your scope of "exploit" - this answer shows a way to exploit the HTML.
May
19
comment jpeg hide & seek - get password hash
From what I can gather from your question: you have an image and you want to know if steganography was used to hide a string of random characters (password hash). To extract this string you want to use a very specific program. I'm not sure how we can answer a question like that with what we've been given.
May
19
comment Break in attempts from secureserver.net
GoDaddy provides DNS and other web services. It is likely that on of their customers has been compromised or someone is using their services for these attacks. It does not mean that GoDaddy itself has been compromised.
May
19
comment How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?
do compound queries work otherwise on the app?
May
19
comment Disadvantages of disabling RC4 in SSL/TLS
@Freedom some web apps do not work on newer browsers. I know a few companies that require IE 8 max to run their product.
May
13
comment Is a website published in an obscure directory comparably secure to being placed behind a login?
True, but with notable exceptions: client-side proxies, the server's access logs, and load-balancers/SSL off-loaders on the server's side.
May
13
comment Is a website published in an obscure directory comparably secure to being placed behind a login?
The URL itself is not encrypted, though. Any node in the path can see the URL and then retrieve that file.
May
13
comment How does my browser detect my location, even via proxy?
I like it. I polished some of the wording to remove the confusion at the end.
May
13
comment How does my browser detect my location, even via proxy?
I completely agree with you, but you are speculating that the x-fwd-for headers are the problem and even phrase your question as 'something to check'. This could, in fact, be the answer, but it is still speculation at this point. If this was a comment to get the OP to check this - THEN you have a definitive answer. That's all I'm saying.
May
13
comment What is the best setup to keep my email private from both attackers and government agencies?
@Iszi I've set up end-to-end and it only works if the recipient is also using the same encryption.
May
13
comment What is the best setup to keep my email private from both attackers and government agencies?
If you plan to email outside of your company, your setup might not get emails through to the recipient.
May
13
comment HSM maintenance
MUCH clearer question! Thanks.
May
12
comment Is it safe not to encrypt ping packets?
"ping" in this case means "heartbeat"?
May
12
comment Risk of spyware on seized devices
Downvotes do not require comment. The tooltip for the downvote button simply says: "This answer is not useful". If I thought the question could be improved, I would have commented to help you do that.
May
12
comment Risk of spyware on seized devices
@Freedom I downvoted because you do not include anything relevant to the question, but a lot of speculation and suspicion and blanket anti-American sentiment, which is inappropriate. And, no, I'm not American. Americans are people, just like you. Some are good, some are not so good.
May
12
comment Has HTTP bogus request type “COOK” been used in any known website attacks?
@WhiteWinterWolf that's the top hit in my Google search, too
May
12
comment What are security risks of connecting to my home vpn from my work?
@JorgeeFG this answer is the correct one - you are NOT qualified to accept the risks of your actions - only the IT manager can accept those risks, and therefore is the only one who can approve activities. You might not see risks as probable, but then that's not your job.