Fiasco Labs

697 reputation

bio	website
	location
	age
visits	member for	1 year, 4 months
	seen	29 mins ago
stats	profile views	64

Been on the Internet since before there was an Internet. Remember UUCP, news feeds, and Gopher?

	697 reputation	bio	website		visits	member for	1 year, 4 months
17 badges		location			seen	29 mins ago

summary answers questions tags badges favorites bounties reputation activity

125 Actions

suggestions reviews revisions comments badges posts accepts all

Nov 20	comment	Whats the best way to make my internet traffic anonymous? And all it takes is one small, insignificant slip-up or omission in detail to completely bypass all attempts at anonymizing your internet access.
Nov 20	comment	Should I give developers admin rights or leave as power users? I've come to agree on this. Developers don't need admin rights until they can fully understand creating software that runs properly under a limited user environment. I'm fed up with software that requires admin rights for userspace configurations.
Nov 19	answered	what is the difference between boot-sector virus and rootkits?
Oct 29	comment	Unmasking passwords during sign up, is it a good idea? Masking doesn't prevent keylogging... Just shoulder surfing.
Oct 22	comment	Why do we lock our computers? Prevents casual fiddling. Network resources aren't available unless you have access to the account on the DC so the boot disk gets you nowhere. One of our company's worst kerfluffles was when an office manager got in the habit of leaving her computer in payroll and one of the clerks decided to use that information. Being in the habit of locking would have prevented the issue, or not leaving the program up in that window, etc. While your premise is correct, it is overthinking around the real reason locking or logging out is used.
Oct 20	comment	Are tracking cookies illegal? HTTP as a protocol was designed stateless and requires a token to know who you are. That means it suffers from advanced Altzheimer's disease and cannot remember you unless it gives you a note with your name on it which you give it back when you ask it for the next transaction. This is known as establishing a session and therefore is a fundamental part of running an ecommerce website.
Oct 18	comment	My bank makes me enter my password using the mouse. What's up with that? General thinking on this, keycode scanners that tap into keyboard output are supposedly blocked out of the action, some sort of screen shot technique is required instead to recover the password. Mobile app isn't using a PC Keyboard device and hardware level keypad logging would be dependent on the device manufacturer, so probably less likely to see specialized logging software than the usual standards based PC keyboard.
Oct 13	comment	Wi-fi security using WPA or WEP WEP ceased to be considered security a long time ago and doesn't protect data at all.
Oct 6	comment	Does a working JTAG diagnostics port on Android phone add unnecessary risk? Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. And if it doesn't have an automatic self-destruct on opening the case, you can prod it in any number of ways to get it to spill information.
Oct 6	comment	Does a working JTAG diagnostics port on Android phone add unnecessary risk? Go look at a Bus Pirate. You don't need ports to extract information. Basic answer is, "Don't lose your phone". If you're that important and you've put delicate information on it in an unencrypted state, it's free for anyone with technical expertise to extract.
Aug 26	comment	How do you prevent physical backups from being stolen? Sometimes negative examples are the best for driving home the point. I'd add to the list, Having spent a gobzillion dollars on failed data recovery, flounder around for a month or more unable to properly service your customers and then go bankrupt six months later from the lingering damage. In small businesses that is a distinct possibility, everythings lost, accounts receivables payment status is in question, all your customers are upset and decide to go get professionals to do their work as you obviously are not.
Aug 24	answered	Is a stack trace of a server application a vulnerability?
Aug 13	answered	What is social engineering, how does it relate to security and how can it affect my business?
Aug 10	awarded	Citizen Patrol
Jul 30	comment	How to detect a virus in a network card? Noted over on Heise Security 07/30/2012: At the Black Hat hacker conference, Australian security expert Loukas K (aka Snare) has demonstrated a rootkit which is able to insert itself into a Macbook Air's EFI firmware and bypass the FileVault hard drive encryption system. We'll have to see how far this goes...
Jul 25	comment	What was Microsoft trying to do when they had Windows Updates over their website? at the time most computers weren't constantly connected to the internet Right 'nuff on that one. I had networks where I had to manually download the patches, burn them to disk and manually transport them onto location. Dial-up stunk if you had it, several manufacturing operations didn't have internet access and thankfully, we only had to worry about stability patching.
Jul 25	comment	What was Microsoft trying to do when they had Windows Updates over their website? Back then, "Web App" -- "Huh? What's that?" ActiveX was a needed component to make Windows Update work to scan the system and run the process. It was part of IE as a separate module. For the most part, the above paragraph is a 100% Hindsight conjecture trying to compare the Apples of today with the Oranges of yesterday. Most of it didn't exist back then.
Jul 10	comment	How should I tell an organisation that they are vulnerable when I wasn't given permission to check? Let this be a lesson to you, no finger poken among der blinken lights lest der bolts of electricity rise out and smite thyne asse. Same goes with networks, back off, forget it and never return. This is one of those situations where no good deed goes unpunished, no harm, no foul and keep your fingers crossed.
Jun 30	revised	Spider Attack from several search engines at once UA String spoof
Jun 30	comment	Spider Attack from several search engines at once @curiousguy Will do on the @. Glad to hear on the IP being ok, I had to fend off some non-Baidu traffic about a year ago in an isolated script kiddie attack. The UA didn't match to the known Baidu blocks so they went into the router "black hole" ACL for the duration.