Zoredache

228 reputation

bio	website	plus.google.com/…
	location	Anacortes, WA
	age	36
visits	member for	2 years, 4 months
	seen	May 22 at 18:37
stats	profile views	14

Real Name: Chris Francy

I work as a Senior Network Analyst at Northwest Educational Service District #189 in the Technology Services department.

The Technology Service department, in addition to supporting the staff at NWESD, provides network support services to 35 K-12 school districts in Northwest Washington region.

In my free time, when I am not at work or answering questions, I play a lot of video games on the PC (Steam Profile).

You can find more links to various websites and social networks on my Google profile.

	228 reputation	bio	website	plus.google.com/…	visits	member for	2 years, 4 months
29 badges		location	Anacortes, WA		seen	May 22 at 18:37

summary answers questions tags badges favorites bounties reputation activity

52 Actions

suggestions reviews revisions comments badges posts accepts all

May 17	comment	How to avoid scripts with hardcoded password? Does a key-pair really change things though? You still have a set of credentials stored on the filesystem. You have only really changed the size/type of the credentials. Unless of course you are doing something fancy with a hardware security device where the private key isn't on the filesystem.
May 12	comment	How can I punish a hacker? @nneonneo, did miss the pretty obvious sarcasm?
Apr 29	comment	Why are Lengthy Password Stronger Than Complex? If the attacker knows that a password is composed only of correctly spelled lower case English words, then you don't have to attack character by character. You attack word by word.
Apr 19	comment	TrueCrypt External Multimedia Hard Drive Truecrypt is volume level encryption. Anything within that truecrypt volume will be encrypted. Any files, filesystem meta-data, deleted files. Each and every block is encrypted. The only way to access is it is by decrypting it.
Apr 19	comment	Could you attack a port without knowing what service was listening? A large number of services will identify themselves in some way when you connect to the port. IE `nc localhost 22` returns `SSH-2.0-OpenSSH_5.9p1 Debian` on my system.
Apr 13	comment	Why should I use the VPN? the term VPN covers a broad range of technologies, that can connect specific hosts, or whole networks together. The connection, may be encrypted, but can also be unencrypted. So what you use it for, depends on what you want to use it for. You configured to fit your requirements.
Apr 9	comment	How can I protect my internet-connected devices from discovery by Shodan? @Matt, Or at least don't use the stock firmware. The security problem is about the firmware.
Mar 27	comment	How to insert custom packets into SSL handshake? Are you aware of any proxies that will interact with this non-standard SSL server? For example can you get stunnel to connect to it?
Mar 27	comment	Why on earth would anyone use the 'top secret' option of IPv4? `If I wrote a networked program which labeled all of its packets` - It is almost certainly nothing unusual would happen. Almost no equipment in the world is set to do anything at all when those options are use.
Feb 1	comment	set uid for reboot binary & pm-suspend : security hole? Consider that many Linux systems setup the `CTRL-ALT-DEL` in the `inittab` to result in your system running `reboot` or `shutdown -r`. If you are already permitting anyone with physical access to initiate a shutdown just by a magic key-sequence, is their additional danger by permitting anybody with a shell run a reboot? I would guess probably not.
Feb 1	comment	How should one prepare himself for a job interview for penetration testing? {sarc}Well the best method would be to hack in and retrieve their interview questions. Then you will be prepared for exactly what they will ask.{/sarc}
Feb 1	comment	When changing a password using a WebPage, must the old password be entered on the same screen? It seems pretty much time based to me. If the user was changed for their password in ~15 seconds ago, then the risk that someone stole their session or device seems pretty minimal. The longer the interval between the last password challenge and updating the password, the riskier it becomes.
Jan 30	awarded	Talkative
Jan 30	comment	What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login? Generate your SSH keys with openssl if you like. The only part that is special is the public key.
Jan 17	comment	Is there a law against one email containing both a login and a password? There is the law of common sense. Sending a password over an insecure communication channel is a violation of common sense.
Jan 11	comment	Disabling authentication via DSA keys in OpenSSH? openssh.com/txt/release-2.5.1p1 - `DSAAuthentication` is obsolete.
Jan 11	comment	Disabling authentication via DSA keys in OpenSSH? Why do you want this?
Dec 13	comment	Firewall philosophy I haven't looked at the Cisco stuff lately, but last time I setup a Cisco PIX/ASA, the default policies were set to permit outgoing, and block incoming. So this type of setup isn't exclusively for soho stuff.
Nov 19	comment	Should I give developers admin rights or leave as power users? You should give them the ability to run virtual machines perhaps? That way they can develop in an development environment, and they can leave their desktop alone.
Sep 12	comment	Does anyone know how to “tcpdump” traffic decrypted by Mallory MITM? This seems like the thing you would create a debug rule for. Personally, I tend to use stunnel for debugging things like this, I find it is easier to setup.