229 reputation
12
bio website
location United States
age
visits member for 2 years, 8 months
seen Oct 25 at 1:26

Oct
23
answered Prevent logging in by pressing Enter - security by obscurity?
Jul
14
awarded  Yearling
Feb
5
answered How does the predator network prevent outside control by an attacker?
Oct
1
comment How to completely prevent bufferoverflows in networking software?
"All it takes is a programming language which checks array bounds". If only that were so. The problem is that these programing languages may themselves contain buffer overflows which an evil doer could exploit. Just look at the problems Java has had just over the last few months.
Sep
11
answered Is Spoofing a CA signed certificate possible?
Aug
28
comment Does GateKeeper on OS X 10.8 offer any reasonable protection from exploits?
I just finished updating a downloadable OS10 desktop app for Gatekeeper. You can always run any downloaded unsigned application just by right clicking it and selecting 'open. This warning dialog is not that different from the 'identified developer' dialog. Gatekeeper is better than nothing, but can be defeated with just a bit of human engineering.
Aug
13
answered Protecting critical state infrastructure from the aftermath of a nuclear blast
Jul
5
comment Is there a way to store user files without being able to decrypt them?
What you are asking for is called a 'Trust No One' (TNO) or 'Zero Trust' architecture. In the USA TNO is required for web applications in the health care space. In a TNO system it will not be possible for the operator of the server to recover the password of the clients, because only the client can have the encryption keys.
May
17
comment Risks of giving developers admin rights to their own PCs
How will you develop an installer, or a Windows Service, or an ActiveX component, or an interprocess communications layer, or use an embedded web server without local admin access?
May
17
comment Risks of giving developers admin rights to their own PCs
@Ramhound - That's why you have separate QA team with a written test plan. It's not an excuse for hogtying your devs for the sake of IT empire building.
Apr
17
comment Protection against a fired IT employee
Insightful comment Brad.
Apr
16
comment How can I make it more difficult for a user to create multiple accounts?
If users with multiple accounts from one person are a problem for a web application I don't think there is a way to really stop them with network level code. I'd look at how Stack Exchange sites work, with limited privileges until you've been around long enough to have some creditability. There are a number of sites that I visit where I'd be glad to Paypal a dollar to be validated as a real person, so as to seperate real people from trolls.
Apr
12
comment Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?
Here is how Stuxnet altered usb drives: symantec.com/connect/blogs/stuxnet-lnk-file-vulnerability
Apr
5
answered Are services like Hide My Ass and UnoDNS reasonably safe to use?
Apr
2
awarded  Teacher
Apr
2
answered What programming language is Stuxnet written in?
Mar
26
awarded  Supporter