meta user
network profile
| bio | website | security.stackexchange.com |
|---|---|---|
| location | Florida | |
| age | 31 | |
| visits | member for | 2 years, 5 months |
| seen | 8 hours ago | |
| stats | profile views | 548 |
I'm not the droid you're looking for.
|
Jun 6 |
comment |
Truecrypt Bruteforce, dictionary atack @TildalWave You forgot IT Security Meta as an option for contesting question closure. |
|
Jun 4 |
comment |
What are the statistics on how often client form submissions fail CAPTCHAs? Welcome back, Graham! Unfortunately, I see a few problems with this question. First, it's really three separate questions: "Do you track CAPTCHA failure rates?", "What are the CAPTCHA failure rates observed?", and "Is the failure rate reasonable?". The first and second are polling questions, which are against StackExchange policies. Even if objective sources could be found for this data, the statistics will vary across those sources and over time. The last question is one that is up to each admin and scenario - nobody here can give one answer that's usable to everyone. |
|
Jun 4 |
comment |
I gave my wi-fi code and now I am afraid that he may hack my PC. Is this possible? @peterph Revealing the password alone would not, but it would put an attacker in a better strategic position than if they were coming across the Internet. It's much easier to attack a system from directly its LAN via weaknesses in its hosted services or network protocol handlers, than from the Internet where there are several intervening devices to work through. |
|
May 30 |
awarded | Nice Question |
|
May 29 |
comment |
Can unencrypted keys & logins be kept out of program memory? @Sulla There is, with Hardware Security Modules. The HSM does all the crypto work so that the keys never need to pass through the CPU or RAM. However, if the attacker has physical access to the RAM then he will equally have physical access to the HSM so the point of where the keys are stored and processed is rendered moot. |
|
May 29 |
awarded | Popular Question |
|
May 29 |
awarded | Famous Question |
|
May 28 |
comment |
How secure is the Windows event log, and how is it secured? @MurrayA Essentially, the answer breaks down to file permissions. That's really all that stands between anyone and the ability to edit or delete the event logs. As munkeyoto says, getting the logs sent to another system in real-time will help mitigate this. |
|
May 22 |
comment |
Is “non-repudiation” automatically proven, given the other three tenets of info security? Where are you getting these "four tenets" from? I've always heard it as three: "CIA". CIA is not Confidentiality, Integrity, Authenticity. It's Confidentiality, Integrity, Availability. Authenticity & Non-Repudiation would be a sub-set of Integrity, I think. |
|
May 20 |
awarded | Nice Answer |
|
May 17 |
comment |
What is the difference between Key Escrow and a Recovery Agent? Strictly speaking, the "Key Escrow" isn't just something that's implemented for legal reasons. It could just be the way the company chose to implement their recovery process. Other than that, the distinction between Escrow vs. Agent is pretty accurate here. |
|
May 14 |
comment |
Source where you can find if a CVE has a patch or not The only reliable source for stating whether or not there is a patch, is the vendor of the affected software - and they don't always make it easy to search by CVE. There are other sites that try to aggregate this data, but I wouldn't rely upon them to definitively state that there isn't a patch. |
|
May 9 |
comment |
Intel How Strong is Your Password page, good advice? @AviD & Adnan It would at least help assure you that the claims regarding the site's operation are made by a relatively trustworthy source. As it is now, we cannot have any confidence that the site we're viewing is being served to us by Intel. Joe User isn't savvy enough to inspect the JavaScript, but most are at least a little familiar with how to check for SSL indicators in their browser. SSL is not (just) about encryption. Whether they should be punching their passwords in there at all or not is a bit of a different issue. |
|
May 8 |
comment |
Is salting a hash really as secure as common knowledge implies? @Gilles What I meant to say then is that it needs to be unique for each user, not for particular password strings. |
|
May 8 |
comment |
Is salting a hash really as secure as common knowledge implies? Suggestion: Change "it needs to be unique" to "it needs to be unique for each password". |
|
May 2 |
reviewed | Close Example of malware that spreads via USB? |
|
May 2 |
comment |
High-frequency noise deterrents I noticed the side-note about not knowing the effect on animals. I presume animals with higher hearing ranges than humans may detect these and perhaps be disturbed. Considering that animals are used in service to the perceptually impaired and other disabled individuals, I'm almost surprised an organization like the ADA hasn't been all over this. Another note: There are other "unintentional radiators" of these noise frequencies. CRTs (thankfully becoming rarer) are perhaps among the most notorious, but some other electronics put out a discernible high-pitch whine when in use. |
|
Apr 30 |
comment |
CTRL+ALT+DEL Login - Rationale behind it? Yeah, I'm still a little confused as to why Linux didn't use CTRL+ALT+DEL - Windows had to deal with the same "reboot button" issue, and they did reasonably well. Good additional detail here, though. |
|
Apr 30 |
reviewed | Close Create additional database in server using sql injection |
|
Apr 30 |
reviewed | Close Web application security standards/certificates |
