283 reputation
211
bio website plus.google.com/…
location Anacortes, WA
age 38
visits member for 3 years, 6 months
seen yesterday

Real Name: Chris Francy

I work as a Senior Network Analyst at Northwest Educational Service District #189 in the Technology Services department.

The Technology Service department, in addition to supporting the staff at NWESD, provides network support services to 35 K-12 school districts in Northwest Washington region.

In my free time, when I am not at work or answering questions, I play a lot of video games on the PC (Steam Profile).

You can find more links to various websites and social networks on my Google profile.

profile for Zoredache on Stack Exchange, a network of free, community-driven Q&A sites


Apr
14
awarded  Popular Question
Jan
30
answered Why does changing physical router not warn of possible man in the middle attack?
Nov
27
comment Can you securely wipe an SSD by filling the remaining space with bogus data?
SSDs do not make the entire internal capacity visible via the sata/usb interface. There is additional storage that is used when blocks fail by bad block mapping algorithms inside the drive. Since you cannot get to those blocks via the standard interface there is no way to over-write it simply using software. The assumption here is that a motivated attacker might have the skills to pop that drive open and directly access the hardware.
Nov
27
comment How much are 0-days worth?
Simple, they are worth as much as somebody will pay for them.
Sep
14
awarded  Student
Sep
14
comment OpenVPN dhparam
Seems like an openvpn tag would also be appropriate here, but I don't have the privileges to add it yet.
Sep
14
asked OpenVPN dhparam
May
17
comment How to avoid scripts with hardcoded password?
Does a key-pair really change things though? You still have a set of credentials stored on the filesystem. You have only really changed the size/type of the credentials. Unless of course you are doing something fancy with a hardware security device where the private key isn't on the filesystem.
Apr
29
comment Why are Lengthy Password Stronger Than Complex?
If the attacker knows that a password is composed only of correctly spelled lower case English words, then you don't have to attack character by character. You attack word by word.
Apr
19
comment TrueCrypt External Multimedia Hard Drive
Truecrypt is volume level encryption. Anything within that truecrypt volume will be encrypted. Any files, filesystem meta-data, deleted files. Each and every block is encrypted. The only way to access is it is by decrypting it.
Apr
19
comment Could you attack a port without knowing what service was listening?
A large number of services will identify themselves in some way when you connect to the port. IE nc localhost 22 returns SSH-2.0-OpenSSH_5.9p1 Debian on my system.
Apr
13
comment Why should I use the VPN?
the term VPN covers a broad range of technologies, that can connect specific hosts, or whole networks together. The connection, may be encrypted, but can also be unencrypted. So what you use it for, depends on what you want to use it for. You configured to fit your requirements.
Apr
9
comment How can I protect my internet-connected devices from discovery by Shodan?
@Matt, Or at least don't use the stock firmware. The security problem is about the firmware.
Mar
27
comment How to insert custom packets into SSL handshake?
Are you aware of any proxies that will interact with this non-standard SSL server? For example can you get stunnel to connect to it?
Mar
27
comment Why on earth would anyone use the 'top secret' option of IPv4?
If I wrote a networked program which labeled all of its packets - It is almost certainly nothing unusual would happen. Almost no equipment in the world is set to do anything at all when those options are use.
Feb
1
comment set uid for reboot binary & pm-suspend : security hole?
Consider that many Linux systems setup the CTRL-ALT-DEL in the inittab to result in your system running reboot or shutdown -r. If you are already permitting anyone with physical access to initiate a shutdown just by a magic key-sequence, is their additional danger by permitting anybody with a shell run a reboot? I would guess probably not.
Feb
1
comment How should one prepare himself for a job interview for penetration testing?
{sarc}Well the best method would be to hack in and retrieve their interview questions. Then you will be prepared for exactly what they will ask.{/sarc}
Feb
1
comment When changing a password using a WebPage, must the old password be entered on the same screen?
It seems pretty much time based to me. If the user was changed for their password in ~15 seconds ago, then the risk that someone stole their session or device seems pretty minimal. The longer the interval between the last password challenge and updating the password, the riskier it becomes.
Jan
30
awarded  Talkative
Jan
30
comment What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?
Generate your SSH keys with openssl if you like. The only part that is special is the public key.