14,857 reputation
12865
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years
seen Dec 17 at 23:50

Security Architect

Owner of: SelfPhish.com


Dec
2
comment LastPass Bootstrap on New Android Phone
@JinghaoShi use a short password and enable 2FA?
Dec
2
comment LastPass Bootstrap on New Android Phone
It's hard not to read this question simply as "how do I copy/paste in Android?" There isn't a security question here, but more of an Android support question.
Dec
2
comment Problem setting up two Wi-Fi module for two way communication
Where is the security question here? This would be better on a networking site.
Dec
1
comment What is the shortest malicious XSS possible?
Because it is dependent on the resources available on the web server, this question might be a little broad.
Dec
1
comment What is the shortest malicious XSS possible?
There are a few resources that discuss this: labs.neohapsis.com/2012/04/19/xss-shortening-cheatsheet
Dec
1
comment Is there a best practice to handle vulnerability scanning attempts?
I disagree - log those IPs at least. If they escalate, you'll have important recon phase data to help you understand the context of the later attack. Otherwise, yeah, there is no need to mount an active response.
Dec
1
comment How Regin hides running instances of itself?
It might be difficult to provide a definite answer without looking at the code?
Dec
1
comment Is “Why Should You Avoid AES In MySQL?” true?
I'm not sure that this addresses the question. This is about a caution on encryption in general, and not just AES. You still need to encrypt server-side if you want to do something like encrypting a column containing sensitive data.
Dec
1
comment Client Cert Auth
This is a tomcat-specific config question. You'll have better luck on ServerFault.
Nov
29
comment W3af and automated vulnerability scanners vs manual testing
Add to your list that the automated tests are more easily repeatable after remediation.
Nov
29
comment Nmap from Kali Linux and from Amazon EC2 instance - vastly differing results
Can you edit your question to include sanitized command you're running on both? Consider that EC2 might be blocking some traffic out (or in) as suspicious.
Nov
28
comment google reCAPTCHA V2 “Use of undefined constant ..”
This is a code review question and not an Info Sec question.
Nov
28
comment Why does integrity exclude confidentiality?
@hansn No. It really, really doesn't matter.
Nov
28
comment Why does integrity exclude confidentiality?
@hansn This explanation is is a complete over-simplification of the concepts. It is so simple, it's wrong.
Nov
28
comment Secure voice app
Then where does the landline come in?
Nov
28
comment Secure voice app
@AndréDaniel I know that's what he meant. He's looking to make landline calls, though, which means he's looking for control over the telco that simply isn't possible. You'd have to have a custom modem on each end.
Nov
28
comment Are Linux vendor-supplied security updates enough for PCI Compliance?
I'm not sure that you can state that CentOS is the 'vendor' of PHP, but rather the supplier of install packages. From a practical point of view, if a distro fails to update its own repo and there are known security patches that need to be applied, you can't blame the distro repo for your lack of patching. That's why there are PCI patch scanners (that the OP used).
Nov
28
comment Are Linux vendor-supplied security updates enough for PCI Compliance?
I understand your point, but the OP stated they they knew that the versions installed were behind on versions. Once you know, you have the responsibility to patch yourself.
Nov
28
comment Encrypt Lightning event invite mails with pgp
This is a product-specific configuration question. You'd find better help on other sites.
Nov
28
comment Secure voice app
How does one "encrypt sound"? I'm not sure that you understand how telephones work. They haven't used "sound" in many decades.