meta user
network profile
|
Dec 15 |
awarded | Yearling |
|
Nov 2 |
comment |
Practices for storing username/password in Web applications Have you looked at the answers here: security.stackexchange.com/questions/22817/… ? |
|
Oct 25 |
comment |
How to encrypt database connection credentials on a web server? While there are a number of options the easiest under Ubuntu is probably to use EFS to encrypt the user's home folder that is running your process. An after the fact method is here: howtogeek.com/116032/… but it's certainly not the only option. |
|
Oct 19 |
comment |
Safety of opening .txt files via URL This is a good answer and is a typical audit test. Load a simple script tag into a text document with an alert, load it to your host and open it via the browser. Since the type is text/html, in many browsers the JS will execute and may be malicious in nature. (That said, the mime type could be anything, but this is an example of why one has to be careful of how they redisplay uploaded files). |
|
Oct 19 |
answered | Revoked certificate validation using past times |
|
Oct 19 |
comment |
Sharing of Wireless Security and Encryption Settings I should have put that in an answer instead of a comment :\ |
|
Oct 19 |
comment |
How to encrypt database connection credentials on a web server? If you're going to downvote, provide commentary please. |
|
Oct 19 |
accepted | The Creation of Secure Software Development Environments |
|
Oct 19 |
revised |
The Creation of Secure Software Development Environments Add link to document in question |
|
Oct 19 |
accepted | Changing windows client form values at runtime |
|
Oct 19 |
comment |
Changing windows client form values at runtime Thanks for DDE - it was the perfect attack channel proof. Though we were using Oracle Advanced Security and user entered credentials, so I couldn't tamper with anything once on the wire, the ability to demonstrate that attack and why the client itself was vulnerable was useful. We couldn't get rid of the VB6 application, but we did change the architecture so that communications take place to a WCF service that validates credentials, user accesses, values passed, etc. |
|
Oct 19 |
comment |
Sharing of Wireless Security and Encryption Settings @Henning: Non broadcasting SSIDs won't show. |
|
Oct 19 |
revised |
How to encrypt database connection credentials on a web server? added 244 characters in body |
|
Oct 19 |
answered | How to encrypt database connection credentials on a web server? |
|
Oct 19 |
comment |
How to encrypt database connection credentials on a web server? This assumes that the database is running on the same system as the web server itself - this is not a good idea and DISA/NIST specifically reccomend against it. Still having the configuration files in a non-world readable location is key. |
|
Oct 15 |
answered | attack/abuse notification email template |
|
Oct 1 |
comment |
Digital Signature and Verification? Correct. The private key is always used for the sensitive part of the operation (encrypting a message hash for signing, or decrypting a message intended for a specific person) |
|
Sep 28 |
comment |
PCI-DSS compliance for business with only swipe terminals Move your swipe terminals to a separate network (can be logically segmented) compliance at that point since you're on a single purpose system/single purpose network with a PCI L1 provider doing the processing should make you eligible for the shortened self-assessment: pcisecuritystandards.org/documents/pci_saq_a_v2.doc it's the place to look anyway (the site/docs) |
|
Sep 27 |
comment |
How can I scan open ports without being traced back Use proxychains or anything else similar to tunnel your traffic across the established tor connection: examples -- commondork.com/2009/06/26/tunneling-nmap-through-tor -- aldeid.com/wiki/Tor/Usage/Nmap-scan-through-tor |
|
Sep 27 |
answered | How can I scan open ports without being traced back |
