1,178 reputation
411
bio website levii.com
location
age
visits member for 3 years, 4 months
seen Jan 6 at 17:58

Feb
13
awarded  Enlightened
Feb
13
awarded  Nice Answer
Dec
15
awarded  Yearling
Dec
3
awarded  Popular Question
Oct
23
awarded  Nice Answer
Dec
15
awarded  Yearling
Nov
2
comment Practices for storing username/password in Web applications
Have you looked at the answers here: security.stackexchange.com/questions/22817/… ?
Oct
25
comment How to encrypt database connection credentials on a web server?
While there are a number of options the easiest under Ubuntu is probably to use EFS to encrypt the user's home folder that is running your process. An after the fact method is here: howtogeek.com/116032/… but it's certainly not the only option.
Oct
19
comment Safety of opening .txt files via URL
This is a good answer and is a typical audit test. Load a simple script tag into a text document with an alert, load it to your host and open it via the browser. Since the type is text/html, in many browsers the JS will execute and may be malicious in nature. (That said, the mime type could be anything, but this is an example of why one has to be careful of how they redisplay uploaded files).
Oct
19
answered Revoked certificate validation using past times
Oct
19
comment Sharing of Wireless Security and Encryption Settings
I should have put that in an answer instead of a comment :\
Oct
19
comment How to encrypt database connection credentials on a web server?
If you're going to downvote, provide commentary please.
Oct
19
accepted The Creation of Secure Software Development Environments
Oct
19
revised The Creation of Secure Software Development Environments
Add link to document in question
Oct
19
accepted Changing windows client form values at runtime
Oct
19
comment Changing windows client form values at runtime
Thanks for DDE - it was the perfect attack channel proof. Though we were using Oracle Advanced Security and user entered credentials, so I couldn't tamper with anything once on the wire, the ability to demonstrate that attack and why the client itself was vulnerable was useful. We couldn't get rid of the VB6 application, but we did change the architecture so that communications take place to a WCF service that validates credentials, user accesses, values passed, etc.
Oct
19
comment Sharing of Wireless Security and Encryption Settings
@Henning: Non broadcasting SSIDs won't show.
Oct
19
revised How to encrypt database connection credentials on a web server?
added 244 characters in body
Oct
19
answered How to encrypt database connection credentials on a web server?
Oct
19
comment How to encrypt database connection credentials on a web server?
This assumes that the database is running on the same system as the web server itself - this is not a good idea and DISA/NIST specifically reccomend against it. Still having the configuration files in a non-world readable location is key.