132 reputation
17
bio website undermyhat.org
location Amsterdam, The Netherlands
age
visits member for 2 years, 7 months
seen Apr 12 at 15:19

"Logic gets you from A to B. Imagination takes you everywhere"

Creator of the .NET XSLT 3.0 processor: Exselt

You can reach me via Twitter, by mail info@exselt.net, on my blog Under My Hat, my outsourcing and consultancy firm Abrasoft or at Exselt.net.


Oct
16
awarded  Popular Question
Oct
5
awarded  Notable Question
Jan
2
awarded  Popular Question
Apr
2
accepted How secure is blocking all incoming connections on my ADSL or cable router?
Mar
30
comment How secure is blocking all incoming connections on my ADSL or cable router?
That's the kind of information I was after. I still requires a user's action (so, in the case of unattended servers, we would seem pretty safe still, unless a specific vulnerability rises).
Mar
30
revised How secure is blocking all incoming connections on my ADSL or cable router?
Better title
Mar
30
comment How secure is blocking all incoming connections on my ADSL or cable router?
So, unless there's a flaw in the firewall on the router itself, you essentially say my assumptions are correct (but I shouldn't feel too safe for other reasons).
Mar
30
comment How secure is blocking all incoming connections on my ADSL or cable router?
@Ramhound: no, there's a difference between outgoing and incoming connections. I only disallow incoming connections. The firewall knows the difference from NEW / ESTABLISHED as explained here. So once a connection is established (i.e., to this very server serving this page) the firewall knows the incoming traffic is connected to my outgoing request. TCP is a connection-based protocol, as opposed to UDP.
Mar
30
asked How secure is blocking all incoming connections on my ADSL or cable router?
Mar
30
comment How secure can IP based login be?
@MarkScrano: I was thinking of the Internet WAN, actually, and that's not so trivial, but user B.W. answered this can be done with BGP attacks for one. But in either case, "100%" in this answer is too strong a number.
Mar
30
comment How secure can IP based login be?
Excellent, that's a clear cut story. Apparently, BGP attacks can happen anywhere, anytime without someone noticing easily. The last line is troubling: "ISPs, he said, have been holding their breath, 'hoping that people don’t discover (this) and exploit it.'"
Mar
29
awarded  Editor
Mar
29
revised How secure can IP based login be?
Probably better to use quotation instead of code-sections.
Mar
29
awarded  Scholar
Mar
29
accepted How secure can IP based login be?
Mar
29
comment How secure can IP based login be?
On the Wikipedia article on IP spoofing it is mentioned that with some effort, it is possible to redirect a response back to a spoofed address. It might be that they mean through a man in the middle or another form of hijacking, but I didn't get that impression. Are you positive on the 100% figure?
Mar
29
comment How secure can IP based login be?
The actual scenario, I should've said, is to limit access by IP addresses on the LAN or on the VPN network. However, word has it, that the client would like access from some people's homes as well. It should be said that the application is hosted under another app that does require authentication, but then it just uses unsecure HTTP requests. All it then takes is picking up the URL (plus the IP spoofing/hijacking) to gain access. At least that's what I think.
Mar
29
comment How secure can IP based login be?
It's kind of interesting that none of these answers (nor in the linked question) explain how a spoofed IP address can receive an answer from the server, other than the obvious man in the middle attack. Ramhound below even says it is 100% impossible. Of course, this is only one aspect of the problems with IP address authentication.
Mar
29
comment How secure can IP based login be?
@Ramhound: I'm not sure which, but I encountered it in several of them. Probably some Apache security book, my PKI book etc, but it's a while ago, and I just know I read it several times somewhere (sorry, not a very substantive answer).
Mar
29
awarded  Supporter