Piskvor

891 reputation

bio	website	frozen.piskvor.org
	location	50° N, 15° E
	age	31
visits	member for	2 years, 4 months
	seen	19 hours ago
stats	profile views	62

Rents brain for food.

	891 reputation	bio	website	frozen.piskvor.org	visits	member for	2 years, 4 months
49 badges		location	50° N, 15° E		seen	19 hours ago

summary answers questions tags badges favorites bounties reputation activity

196 Actions

suggestions reviews revisions comments badges posts accepts all

May 12	comment	Is it compulsory to have https on e-commerce site? @Harlandraka: No idea, sorry.
May 10	comment	Prove that you deleted the file Note also that "special knowledge" could be as simple as "if you can't get the data out of the computer, just take a photograph of the computer screen while content is displayed." Sometimes the low-tech methods work best ;)
May 8	comment	Is it compulsory to have https on e-commerce site? Unless you're Google-sized, Moore's Law has obliterated the "speed overhead" problem sometime during the last decade. And if you are Google-sized, there are also ways to overcome the "speed" issue. TL;DR: "HTTPS is slow" is just an excuse nowadays.
May 8	comment	Is it compulsory to have https on e-commerce site? @Harlandraka: That would depend on many things - jurisdiction of the shopper, your jurisdiction, and most importantly, how good your and the shopper's respective lawyers are ;) In other words, "maybe."
Apr 23	awarded	Nice Answer
Apr 22	answered	Does password-protecting a server's BIOS help in securing sensitive data?
Apr 5	comment	Security seals and the “perception of safety”? @MayankSharma: Do you trust "Agencia Catalana de Certificacio"? Do you trust "AOL"? Maybe, maybe not. I have randomly picked these ones out of the looong list of "trusted CAs" that ships with Firefox; very few people are aware of this list, and the implicit trust they are putting into the CAs (and the browser which ships with them). It only takes one of the CAs on the list to go rogue; this has happened multiple times. The point is, the whole system is already broken; it didn't come down yet only because nobody cares. (Etilasat?DigiNotar?Comodo?No change since then...)
Mar 29	comment	SSH password vs. key authentication `.ssh/authorized_keys` is but the most common way of managing the public keys (and a matter of setting up `sshd_config`); there are various centralized solutions in use.
Mar 29	comment	Why don't wifi managers remember mac addresses for hotspots to defeat the jasager attack? @Smit Johnth: To be honest, I don't know; it's been a while since I've used a Windows computer of my own; from the cursory use I've had, I haven't seen this option with the default wifi manager in Windows 7. In other words, I can't rule out existence of such option on Windows, but I can't confirm it, either.
Mar 27	comment	Email instead of username Case-sensitivity in local part is uncommon nowadays, but not improbable. Bob@example.com and bob@example.com may be, as far as the respective RFC goes, two different e-mail addresses. *It is unwise to assume* identity because it's less work for me**, never mind that the RFC specifically prohibits this: "the local-part MUST be interpreted and assigned semantics only by the host specified in the domain part of the address." You seem to be contradicting yourself: should the local part be munged (`[bB]ob`), or not (`bob+something`)?
Mar 27	comment	Email instead of username I strongly object against the notion that stripping an arbitrary part from the e-mail address "sanitizes" it. While it is true that many e-mail systems treat the `+` character as special, this is merely an informal convention. What's next, "sanitizing" the address by removing the all the characters `a`, '4', '%' and `Q`? (a completely arbitrary choice)
Feb 21	awarded	Nice Answer
Dec 31	comment	Is it useful to determine the name of the server software while doing a penetration test? Note that `db3` tells you that this is a third database server, therefore it is likely that `db1` and `db2` probably have existed at some point in time (and maybe they still do).
Dec 30	awarded	Yearling
Nov 4	comment	How to block or detect user setting up their own personal wifi AP in our LAN? This is workable, under the premise of a complete, provably trusted computing chain - starting from cryptographically authenticated hardware checks and building up from there, verifying on each step. Possible, but expensive and difficult to manage.
Nov 4	comment	How to block or detect user setting up their own personal wifi AP in our LAN? One single acronym: NAT. How do you distinguish whether the data comes directly off the VPN-connected computer, or is NAT-ed through that computer and into the VPN? (Note that it looks exactly the same as if it had originated on the computer)
Aug 21	comment	Why aren't application downloads routinely done over HTTPS? (I'm aware that the Windows situation is very much different, and that most Linux distros use a different integrity mechanism, i.e. package signing)
Aug 21	comment	Why aren't application downloads routinely done over HTTPS? @Lie Ryan: Traffic analysis will give you hints on what is likely to be in transit - but knowing that I'm probably downloading a Firefox binary is much less useful than knowing that I'm downloading a Firefox binary of version Foo, UI language Bar, architecture Baz for OS Quux - not all builds are created equal ;) Moreover, some OSes have repositories hosting many apps - I have a connection open to `https://repository.example.com/`, hosting packages for a distribution; now what am I downloading?
Aug 9	awarded	Pundit
Aug 9	comment	Is it okay to wrap a cryptographic hash with MD5 for storage? @IMB: It definitely doesn't help, and it most likely weakens the security. Also, is "looking clean in storage" one of your priorities?