Reputation
396
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 13
Impact
~25k people reached

  • 0 posts edited
  • 3 helpful flags
  • 126 votes cast
Dec
18
comment What is happening now with the Grub backspace key security vulnerability?
Exploiting this vulnerability requires physical access to the computer during startup - Not necessarily. For a while I had linux boxes attached to a serial console server, that was accessible via dialup modem for OOB. If an attacker was able to bypass the console server authentication, and then wait for a reboot, or force one, they could exploit things remotely. There are also KVM over IP setups that, if improperly configured might permit remote console access without any other physical access. Anyway, this type of setup, is very uncommon these days.
Dec
10
comment Downloaded file checksums
@MikeOunsworth Interesting idea. I suspect if there was real demand we could modify the html spec to permit it. Perhaps add a checksum attribute to the <a> tag or something. Where the value check something would include the hash type, and hash value. So something like <a checksum="sha256:ewjRWqj34h..." href="downloadliso">link</a>
Dec
10
answered Downloaded file checksums
Dec
10
comment Somebody hacked my router and changed my wifi SSID
Is this 'router' provided by the ISP, or something you purchased? If it is your equipment, then a full reset + reconfigure would be a good idea. If it is ISP owned, I would contact your ISP and ask them for help doing a full reset+reconfigure.
Nov
5
comment How should we set up domain administrators?
people that are 100% trustworthy- AFAIK nobody like that exists in reality. Trust, but verify. So you should have some kind of auditing system in place they cannot easily subvert or something similar.
Oct
21
awarded  Nice Question
Sep
14
comment Securely encrypt drive, able to be decrypted independently of the OS
Truecrypt was the most cross-platform option. I haven't used any of the forks to see if the compatibility is being maintained.
Aug
10
awarded  Nice Answer
Nov
14
awarded  Notable Question
Nov
4
revised OpenVPN dhparam
edited tags
Nov
4
comment Pros/Cons to OpenVPN vs “VPN over OpenSSH”
Creating a tunnel over SSH (TCP) has some negative performance implications because of how TCP works. See: sites.inka.de/~W1011/devel/tcp-tcp.html
Oct
31
comment Is using self-signed certificates an option for this m2m scenario
How are you remotely managing these devices? I would be strongly tempted to manage them with puppet, which also happens to include a CA infrastructure and creates per-computer certs on every client. With that in place you simply need to trust your Puppet CA.
Oct
29
comment Clear EFS Cache at Set Interval
So, EFS works. However, he also wants the user to be prompted for their certificate password - Why? What type of attack does he think this would help in defending against? Making things pointlessly complex does not make the system more secure.
Sep
17
comment Download Torrents on University network without detection
I can do to prevent them from knowing? - Pay for your own internet connection.
Aug
19
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
I don't use username+foo@gmail.com only for spam prevention. It is also very useful for building rules within my mailbox. It is very effective for automatically sorting and filtering legitimate messages.
Apr
14
awarded  Popular Question
Jan
30
answered Why does changing physical router not warn of possible man in the middle attack?
Nov
27
comment Can you securely wipe an SSD by filling the remaining space with bogus data?
SSDs do not make the entire internal capacity visible via the sata/usb interface. There is additional storage that is used when blocks fail by bad block mapping algorithms inside the drive. Since you cannot get to those blocks via the standard interface there is no way to over-write it simply using software. The assumption here is that a motivated attacker might have the skills to pop that drive open and directly access the hardware.
Nov
27
comment How much are 0-days worth?
Simple, they are worth as much as somebody will pay for them.
Sep
14
awarded  Student