12,275 reputation
11654
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 8 months
seen yesterday

Canadian insurance company Security Manager.

Owner of: SelfPhish.com


Jul
23
comment Access rights management in large companies
Does LDAP fit into your expectations?
Jul
23
comment Has personal computing security gotten better or worse in recent years?
Quieter threats, that's all.
Jul
23
comment Can I safely use my own statistics to assess password strength on number of times a password is used?
So, a message like, "That password has already been used by many other users of this site. Please choose another." ? Great. Now I have a confirmed password used by N number of users. all I have to do is brute-force account names, which are not private.
Jul
23
comment Open list of adult websites for child internet
DNS services provide this for free. Keeping up with the infinite list is too resource intensive to maintain in a text file.
Jul
23
comment Someone borrowed my phone and Im scared its hacked
HE WAS TOO SHY TO ASK FOR YOUR NUMBER!
Jul
23
comment Someone borrowed my phone and Im scared its hacked
I have NO clue how this could possibly be an IT Security question.
Jul
22
comment Sign contents of entire computer?
You store the hash outside of the computer (email?). Signing performs a hash, then applies your personal key to the hash so that a recipient knows that you are the owner of the contents and the hash. I'm not sure what you gain by adding a Digital Sig.
Jul
22
comment Sign contents of entire computer?
Would a hash work just as well? You could hash the entire contents before you are away from your computer then verify when you get back?
Jul
22
comment CLI API that requires plaintext user details
So, the data supplied by the client have to match the data stored on the server? Sounds like the same problem that password has. How is the password model not the same as your situation? Transmit hashes of the data? What about shifting to Asymmetric Keys instead?
Jul
22
comment PDF Digital Signature
Sounds more like an Adobe support question than an IT Sec question.
Jul
22
comment Security sanity check
Your development team should not be rolling their own encryption processes at all in any event, but certainly not when they don't understand PKI 101. Your recommendation should simply be to follow industry standards. You just have to prove the costs of such a scheme are no more than their proposed solution.
Jul
22
comment How to tell if my laptop is being spied on
One word: mitigation. There is no such thing as perfect security, but you can mitigate the risks.
Jul
22
comment How to tell if my laptop is being spied on
You are already doing what you need to do to determine what data is being sent from your computer: Wireshark. My guess is that you aren't sure how to derive relevancy from the data Wireshark is giving you, which is an understandable frustration. My advice is to keep working along the Wireshark path.
Jul
22
comment How to tell if my laptop is being spied on
Traffic to *.nl and *.ch are perfectly valid if you live in those countries...
Jul
22
comment How to tell if my laptop is being spied on
This question is all over the map. The technical aspects are a distraction from the core question, which seems to be "How can one know they have privacy?" That question has been answered in many ways here on this site. In short, you can't prove a negative (no one has seen my communication), but you can monitor the positive (what I am leaking).
Jul
22
comment Security sanity check
According to the design, the client needs to check on the server's public key for the private exchange. How is that different than HTTPS? Unless they were hoping that by encrypting the public key (?!) the client wouldn't need to check with the CA ...
Jul
21
comment How does Network Address Translation (NAT) increase firewall effectiveness
this looks like a homework question ...
Jul
21
comment Using Free AV to meet PCI Requirement 5
Along with Tim's answer, you might have to cobble together a compliant setup with free AV, but it should be possible, with the right software.
Jul
21
comment Using Free AV to meet PCI Requirement 5
Central logging is a good point. You might be able to rig something up with shipping logs to a collector.
Jul
14
comment This protocol is vulnerable, but why?
I can see that Bob doesn't identify himself, Alice identifies herself and communicates the key (though hashed) to an unidentified party, who then sends it back. If Alice was communicating with Malory, Mal could spoof Bob.