331 reputation
18
bio website
location
age
visits member for 3 years, 4 months
seen Jun 19 at 15:55

Programming: PHP, MySQL, PostreSQL, Bash, JavaScript, jQuery, Java
Sys Admin: Linux servers(Ubuntu, Debian, Slackware, etc)


Jun
28
awarded  Autobiographer
Feb
16
comment Are these SSH passwords of hacked servers?
Or you can just use fail2ban and configure it to ban everybody who enters the pass wrong more than N times. I've configured it to drop all connections from the banned IP for a day or two and so far (3 years) I haven't had any problems. But using auth keys is also a very good idea, since most bots are mainly brute-forcing for a normal pass.
Jul
9
comment Why is faking SSL certificate difficult?
@gman I believe you need to have the original private key of the CA, in order to achieve that. Keep in mind, the public CA key is stored into the user's browser and it's used to validate the actual certificate of the site. In other words, it would be almost impossible to do that. You'd have a better chance to hack the user's browser and import your own self-signed CA. :)
Jun
19
comment When changing a password, does it have to be completely different?
If I knew that your old password was password I would most definitely start with a brute-force attempt starting with your old password and continuing with all it's possible variations. So, changing your password to something completely different is what the OP (and any other user) should do in case he's been asked to, or he simply changes his password for security reasons.
Feb
18
awarded  Commentator
Feb
18
comment How to not reveal that you are using PHP?
In addition to both of you, if you're using apache, it's best practice to set ServerTokens ProductOnly
Feb
18
awarded  Critic
Feb
17
awarded  Yearling
Sep
8
revised Protecting against DOS attacks
deleted 1 characters in body
Aug
19
awarded  Caucus
Apr
12
comment What security measures to have before openly allowing security researchers to hack your site
Your invitation may be accepted as a challenge or provocation. This can trigger more hackers than usual. And if that happens you may end up hacked by many different hackers at the same time. Which will become really hard for your security team to monitor. The other major problem is that you can't rely on hackers willingness to submit real reports or to report at all. :)
Apr
3
comment What steps should one take to provide “reasonable” levels of privacy from a government?
Nice, accurate and strictly to the point answer. +1 :)
Apr
3
answered What security measures to have before openly allowing security researchers to hack your site
Mar
10
awarded  Nice Answer
Mar
2
comment Protecting against DOS attacks
@AviD many php developers use the data they receive via POST/GET "AS IS". They don't do any additional checks over the data they receive. For instance: localhost/user.php?userId=10 . Many developers think "userId" will always be an integer. And that's where someone may try sql injection. In this case it's mandatory you use this approach. The solution eliminates sql injection for the particular example.
Mar
2
comment Protecting against DOS attacks
@AviD sql injection depends on the code style the programmer is using. If he's concerned, he'll always do additional "just in case" actions over the data he receives.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
What I meant to say is the API may have it's own encryption going on inside the code. Anyway sending sensitive information (like username & password) over http is not best practice. Of course you can do it but this opens up a big whole in the security.
Feb
25
comment Why does Safari seem to be accepting an HTTPS connection every other browser rejects?
Did you check if Safari's settings don't automatically accept untrusted ssl certificates?
Feb
25
comment Explanation of SSL handshake with certificate
@RoyiNamir probably this sslshopper.com/article-most-common-openssl-commands.html will help you. Scroll down to "Checking Using OpenSSL" to see how to check a certificate's content.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
I haven't used Posterous but probably they have at least some kind of encryption going on in the api while the client/server communicates. I don't think they'd leave it just plain http. If they did - they're open to a potential attack. If you go to their site though you'll see it instantly redirects to the https. So probably they have something else going on behind the scene :)