13,630 reputation
12060
bio website ca.linkedin.com/in/…
location Canada
age
visits member for 2 years, 10 months
seen 1 hour ago

Canadian insurance company Security Manager.

Owner of: SelfPhish.com


Oct
9
comment Is it a security risk to use an unknown web browser?
Your question can easily be translated as "how dangerous is it to run unknown software of any kind?" You know the answer to that question, and so does Google ....
Oct
9
comment Isn't the behaviour of the switch to flood packets when it's MAC table is still empty dangerous?
Then you've answered your own question: "for some protocols, where the very first packet can contain interesting information, then the situation can result in data leakage". Most organizations would not see this as a 'danger' though because it is limited to a single packet.
Oct
9
comment Isn't the behaviour of the switch to flood packets when it's MAC table is still empty dangerous?
sure, but my point is that C cannot see what A is sending to B, just that A wants to connect to B. In your scenario, there is very little actually exposed.
Oct
9
comment Isn't the behaviour of the switch to flood packets when it's MAC table is still empty dangerous?
"see what it wants to send to host B" - you mean the first of the 3-way handshake and not the payload of the application, right?
Oct
9
comment Having Trouble using SET in Kali
Can you reproduce your tests for metasploit 4.10?
Oct
9
comment SSL protocol : Port 443
Can we assume that you have done some research on this? I'm reading the SSL wikipedia entry and it explain it plainly...
Oct
9
comment Fuzz JSON with Peach framework
Why can't you create a pit file? We need to know that to help you figure it out.
Oct
9
comment Where can I find a collection of tried and true Security Protocols?
The 'term' you might be looking for is 'Design Pattern'
Oct
9
comment future of graphical password authentication
Ok, I get that, but then your question needs to reflect that. You want to understand the feasibility of utilizing a graphical password. It's taken you a long path to get to that core question. Can you edit your question to reflect that?
Oct
9
comment Free alternatives to Windows nap?
product recommendations are a poor fit for this forum
Oct
9
comment future of graphical password authentication
You started out with an interesting question, but you added a lot of opinion-based, open-ended questions that will be difficult to answer. If you want to implement graphical passwords, we can address that question, but the questions of "should I be using graphical passwords" is beyond the scope. Can you focus your question?
Oct
9
comment Security Engineering Potential Threat?
Correct - 2-5 actually are a problem. #1 is a side-effect of a threat.
Oct
9
comment Is XSS prevention only on the frontend enough for JSON services?
@paj28 Input sanitation protects the code receiving it, and 'stored sanity' helps protect the calling code, just like normal code contracts are meant to enforce.
Oct
9
comment Is XSS prevention only on the frontend enough for JSON services?
@paj28 All inputs need to be sanitized, even between internal boundaries, for the very reason Thorium explains. In addition, all inputs stored need to be 'sane', or enforced to be within the expected input type (names, ints, symbols, code snippets, etc.)
Oct
9
comment Api authorization basic concepts in detail
I know, but even an abstract can help the OP. Thanks for the edit.
Oct
9
comment How is chase mobile deposit verified?
You need to read the answers on the referenced question. The point is, they don't need to. You can do all those things with physical cheques.
Oct
8
comment SQL injection — but why isn't escape quotes safe anymore?
you need to clean this answer - spelling, grammar, odd formatting - please put a little more time into your answers
Oct
8
comment How is a biometric authentication system secure?
rainbow tables? it's not about reversing, but about calculating the collision
Oct
8
comment How is a biometric authentication system secure?
You could change the salt used in the hashing algorithm and re-hash when you re-register the user?
Oct
8
comment How is a biometric authentication system secure?
but you could use the hash in order to create a duplicate print and use that (gelatin and a 3D printer)