5,950 reputation
41139
bio website adranos.com
location
age
visits member for 2 years, 3 months
seen Feb 13 at 14:40

@TildalWave said having a sig would encourage more people to view my profile. Also beer.


Jul
17
comment To get security clearance, do I need to be national of the country?
Most IT Security jobs involve sitting on a chair, and using a keyboard, we don't answer questions about peripherals here though.
Jul
17
comment To get security clearance, do I need to be national of the country?
This question appears to be off-topic because it is about Personnel Security.
Jul
17
comment How can I audit which type of Block Mode encryption is being used when no source code is available?
"The Source is Always Available" - Lynks, Reverse Engineer, 2013.
Jul
15
comment To DMZ, or not to DMZ
@Safado what you just explained has nothing to do with a DMZ, and everything to do with network segregation.
Jul
15
comment Can you make a digital signature using the receiver's public key?
@Matthew incorrect. I could tamper with the document and recalculate the 'signature' because the key used to do so is public. A signature of this kind holds no value.
Jul
15
comment How can I see traceroute details in NMAP?
Yeah on linux you would just do traceroute <remote_ip> on windows, tracert <remote_ip> does the same thing.
Jul
15
reviewed Edit How can I see traceroute details in NMAP?
Jul
15
revised How can I see traceroute details in NMAP?
added 25 characters in body
Jul
15
comment How can I see traceroute details in NMAP?
Why not just use traceroute? (Or tracert because you're on windows)
Jul
15
reviewed Leave Open What are the privacy pros and cons of using a public DNS server vs. your own?
Jul
14
comment Why does broad based malware use XOR obfuscation?
+1 pretty much this. There is always a trade-off. Sometimes file size/computational complexity is more important than obfuscation. Certainly highly complex obfuscation technologies exist.
Jul
13
comment Infection risk downloading one’s own file from Gmail
@Edwardo yeah there are a number of things you can do. The easiest would be to use unix tools like find, md5sum and diff.
Jul
13
awarded  Nice Answer
Jul
13
answered One time password over SMS - exposing the Authentication Server to the internet
Jul
13
answered Infection risk downloading one’s own file from Gmail
Jul
12
awarded  Civic Duty
Jul
11
answered What are the advantages of multi-level authentication?
Jul
11
comment Storing session key for iOS app
I'm not an iOS developer, but session keys should not be stored anywhere persistent. Keychains are usually persistent databases so would be unsuitable. A session key lives in memory only.
Jul
11
comment Taking password letters not whole one, is this secure?
An HSM is able to store a private key, perform decryptions internally, and even perform some arbitrary computations. All without ever revealing the private key or the plaintext. The database stores the passwords, encrypted under a public key. To check a password, you feed the encrypted version and the letters to the HSM, and it spits back a yes or a no. This process can be made to be slow also. The point is, nobody ever knows the plaintext password - nobody ever even knows the private key!
Jul
11
comment Taking password letters not whole one, is this secure?
So the SHA family is designed to be fast. They are great for indexing and lookups for that reason. Password hashing needs to be slow, like maxed-out CPU for 3 seconds kind of slow. This makes brute-forcing prohibitively expensive even if the attacker has access to a full database of hashes. Password hashing should be done with something like bcrypt, PBKDF2 or scrypt.