749 reputation
28
bio website
location
age
visits member for 2 years, 3 months
seen 2 days ago

Been on the Internet since before there was an Internet. Remember UUCP, news feeds, and Gopher?


Aug
12
suggested suggested edit on Preferred access list (WPA2 rogue AP)
Aug
12
comment Why is it a good idea that X.509 digital certificates have an expiry date?
Deadman switch. Fails safe.
Aug
12
comment How can you be caught using Private VPN when there's no logs about who you are?
How about to find a chain of few countries who do not have any diplomatic relations... and are willing to sell you out in exchange for cold, hard currency since there are absolutely no laws preventing foreign entities from setting up shop and filtering all paranoid traffic. Money talks, free untampered communications walks in the lands where kickbacks are king.
Aug
10
comment Why do browsers leak their version info to the webserver?
@LucasKauffman - Which is what most current infection servers do anyway. Bright idea security by obscurity question which is trumped by reality.
Aug
5
comment Should we protect web application source code from being stolen by web hosts through obfuscation?
@Xander - basically one of those check-off-the-list items on audits that everybody in security knows to be an exercise in futility, but we include it so the uneducated management knows we've filled the box, whether it does anything or not.
Aug
3
comment Name of security system
Adequate name would be "Airgap Sneakernet". First came across the term with using floppy disks on Xenix for data transfer. Ethernet interfaces were expensive, the 1/2" coax backbone and taps were problematic and serial cable to the back room was capable only of 9600 baud. Tar it to disks and walk it back.
Aug
3
comment Aviation security - Lessons to learn from PlaneSploit
And GPS is spoofable, might as well add that to the mix.
Jul
27
comment My VPS has been shut down now again for the second time for TOS violations, and I really need some help.
Simply shut off sites that will not upgrade. Failure to follow a proper upgrade path which allows for everyone else to lose their services should not be tolerated.
Jul
26
comment Is committing credit card data to this website considered safe?
You can't verify their compliance, and only their credit card processor can tell you that if they've required the company to pass PCI-DSS assessments. This doesn't mean that they actually do pass PCI-DSS requirements as there's a lot of leeway for small operations.
Jul
19
comment Why do most cars use physical keys and no PIN?
Or the fine Oregon Weather penetrates the keypad leaving the customer ticked. It's been done before, nothing new and didn't enhance the customer experience once the novelty faded. (never lose your key again vs oh crud, what's the new number I changed it to). And for any wisenheimer objections to the external keypad. It's to stop the person from entering the car, physical entry is like physical server access, game over once accomplished.
Jul
18
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
Who knows what kind of logic bomb you might stumble upon. It's CYA against malicious traps and horrible misconfigurations that were a hidden disaster waiting to take out data the first time somebody triggered the domino string. Basically a "Sorry you don't have working backups, but that issue predates my breathing on your system" clause.
Jul
16
comment Would a massive blacklist of guessable passwords be useful?
Known as a dictionary?
Jul
9
comment Why does one need a high level of privacy/anonymity for legal activities?
Joe User doesn't worry until the horses have left the barn, at which point suddenly it becomes important and then he just yells and screams a lot about the "injustice". The whole privacy issue has been over and done with for some time as you point out. Society has sold its soul for convenience and corporatism is the new black.
Jul
7
comment Flaws in Crypto Cat
Supreme audit embarrassment.
Jun
29
comment Retrieve Admin Password from router
It's a password. If it was retrievable, the box would be hackable. So, no.
Jun
21
comment Hosting an “IP Rental” address. Is this common, safe?
I have this pile of horse manure that smells sweeter... Read your TOS
Jun
21
comment Does a commercially available self destructing HDD (set in BIOS) exist?
The picture is as fake as they get. I've experienced burned electronics and the edges on the chips are "Rubber Stamp" deformation. As convincing as the fourth Iranian rocket launcher.
Jun
11
comment How to minimize your fingerprint, or become invisible on the web?
You cannot minimalize what is already out there and having established a pattern of use on the web, it's pretty hard to become invisible. What you're currently doing might be hidable for a period of time. Stripping metadata by VPN, TOR, etc work to an extent, but there are metadata leakages at the endpoints.
Jun
9
comment How secure is using a blank index.html / index.php?
The blank index file is enough per directory but it is prone to failure. Usually, when you set up security, you want it to fail safe, not fail and leave the castle gates open. As you point out.
Jun
8
comment How secure is using a blank index.html / index.php?
It is best to shut off displaying directory contents system wide and use .htaccess to display them only where appropriate.