18,248 reputation
23375
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 3 years, 4 months
seen 13 hours ago

Security Architect


Apr
11
comment Why don't merchants use chip reader on credit card terminal?
This question is opinion-based, and not about InfoSec. Each vendor makes a choice and we cannot know why they do/do not.
Apr
11
comment Is AES 256 secure enough for putting Backups to AWS or Dropbox?
Secure enough for what? Who do you want to protect against?
Apr
11
comment Why does Hydra not stop when it finds a password?
You've asked the developer himself - I'm not sure how we can help you: Issue #55 github.com/vanhauser-thc/thc-hydra/issues/55
Apr
11
comment Difference between DNS spoofing and phishing
I'm not sure what you are asking. Phishing is a broad topic and DNS Spoofing is a tactic that can be used for phishing. But you identify that. What is your confusion?
Apr
11
comment Stuxnet - The background functions
Browse exploit-db.com for specifics on 1000's of exploits.
Apr
11
comment Stuxnet - The background functions
There are a thousand vulnerabilities that could be used in a thousand services - what you are asking, then, is the very basics in "remote exploitation". You connect to a vulnerable service in whatever way it is vulnerable, and trigger an exploit. Each vulnerability will have a unique way to connect and exploit.
Apr
11
comment Stuxnet - The background functions
Paragraph 1: "relying on security failures on the target computer". Paragraph 4: "taking advantage of the rootkit and backdoor installed by [other programs]" - you connect to the open service, exploit, run.
Apr
11
comment Stuxnet - The background functions
Deleting and recreating your question in hopes of wiping the close votes will only put you on the radar as someone who tries to circumvent the controls of this forum. I am trying to help you form a better question.
Apr
11
comment Stuxnet - The background functions
Paragraphs 1, and 4 for starters: en.wikipedia.org/wiki/Computer_worm
Apr
11
comment Decentralized e-commerce site, what to do about SSL/security?
@ifm The cost to that plan is getting a wildcard cert, which is pricey.
Apr
11
comment X.509 v3 certificate fields
I'm thinking all these questions are answered with wikipedia en.wikipedia.org/wiki/X.509#Sample_X.509_certificates
Apr
11
comment Official proof (document) that Linux is safer and faster than Windows
@hft I think there might be a language quirk there: "convinced they have to pay a licence for" could also mean that they are convinced they they must always pay to obtain the ability to use an OS (which is not the case for Linux).
Apr
10
comment Decentralized e-commerce site, what to do about SSL/security?
@AronFoster I completely agree - but the fact remains that secure http connections cannot be enforced by the person writing the webpage to be distributed. And, as I point out - it's the sellers who would be most interested in the secure connections (due to issues you point out): the developer can only do so much.
Apr
10
comment Decentralized e-commerce site, what to do about SSL/security?
You cannot force security on your sellers - each one is going to have to be responsible for their own store. This is why services like Amazon exist: to take care of these infrastructure problems for the vendors. Can I ask why you require the requests to be encrypted?
Apr
10
comment Can I include a hash of the password in a .7z file (header or somewhere)?
What you are describing is a "keyring" - you are looking for a unique identifier for each file so that you have an index to use for your lookup in the keyring. You either need to manipulate the header for your use (up the the library of the language you are using), or use something like a hash of the file as the unique identifier (but that assumes the file won't change).
Apr
10
comment Are there any anti-virus programs that have a bot that clicks email links?
There are email clients that will follow links to inspect them before displaying them to the user. What client is being used? What email server is being used? How are you determining that the links have been clicked? You provide very few details for us to help you.
Apr
10
comment How to get started with DNSSEC?
@LamonteCristo why NSEC3 support? Can you explain?
Apr
10
comment Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?
Is DNSCurve a requirement for an acceptable solution for you?
Apr
9
comment Can I include a hash of the password in a .7z file (header or somewhere)?
What you are trying to do is to create a wrapper for 7zip - and that's not common issue. What is 'commonly' done is to use the same passphrase for each file the user owns, or to keep a database of passphrases for each file name. It appears that you want to create a keyring for each user for any number of files in a many-to-many-to-many relationship. If you want control over the creation of the file, look to the library you are using and see what options you have to edit the headers.
Apr
9
comment Can I include a hash of the password in a .7z file (header or somewhere)?
7zip header question here: stackoverflow.com/questions/27535036/…