371 reputation
126
bio website
location Michigan
age
visits member for 3 years, 3 months
seen Mar 22 at 2:22

In no particular order, I'm an:

Engineer; Programmer; Networker; Occasional Sysadmin; Parent; Perpetual Student; Spiritual Being; Wannabe Hacker; Nerd; Political Junkie; Scientist; White Hat; Geek

Also, a recovering, though often relapsing, n00b. :-)

Let's make code, not war.


Mar
20
comment SSH Public Key Authentication vs Username/password for API Access
That sounds like a separate question. Unfortunately, it's beyond my expertise to provide an answer. But, if you ask it, they will come. :)
Mar
19
comment SSH Public Key Authentication vs Username/password for API Access
It's not just that the key is a "long string," like your password might be. The key has other cryptographic properties, including a level of entropy (which you may or may not meet with a password, depending on how you gen it), and a public/private dichotomy that allows the public key to be distributed widely and sent in the clear, giving access to systems without the systems even knowing your private key. In general, it's best to stick to time-tested and widely scrutinized security protocols rather than roll our own, as much as we sometimes want to :). Cheers.
Mar
19
comment Will having 2FA protect me on a potentially insecure network?
Maybe, but only until the first time you log in and notice that 2FA isn't asking for the password :-) Also, some providers/services ask for extra confirmation/info (e.g., security questions, a second code, etc.) when one tries to turn off 2FA on an account, effectively mitigating this attack.
Mar
19
comment SSH Public Key Authentication vs Username/password for API Access
Regarding the update: As a general principle, one should never "roll your own" crypto/auth code. The code that's built into your OS/libraries will pretty much always be more secure as it was written by experts, reviewed by many more, and passed the test of time. Second, it seems to me that this approach is even less secure than using passwords. Since, now, not only is the effective password stored in clear text on the client (as before) and can be used by another host and used to do anything on the server, BUT, now also the server stores a clear-text version of the password. :-/ Use keys.
Mar
11
comment wireshark does't show HTTP requests from other devices
Nice answer. One thing I'd add/change to the list of four options, given that, presumably, the OP is on a home router/switch/AP box that doesn't support the two middle options (and the fourth requires some experience), is possibly getting a cheap 4-port hub (not a switch!) and installing that between the existing wifi router/ap and the upstream network (e.g. DSL or cable modem). Plugging the sniffing computer into another port on said hub will do the trick.
Feb
6
comment When should I use the word hacker, cracker, or black hat?
+1. "miscreant" is also a nice word for the baddies. :-)
May
9
comment Is there an easy way to see a log of SCP activity on a server (ala /var/log/secure for ssh login)?
I know it uses SSH and I thought logs would also go to the same place, but it actually doesn't show up in /var/log/secure nor /var/log/messages. The only evidence of SCP is when I have SELinux and auditd running... in which case it gets logged in /var/log/audit/audit.log.