Shackledtodesk
  • Member for 5 years, 3 months
  • Last seen more than 5 years ago
HTTPS iFrame embedded in HTTP page - PCI implications?
0 votes

It's difficult to believe that the $crmcompany is truly PCI compliant with that kind of "secure" iFrame inside a non-secured document setup. Even if $crmcompany is PCI compliant (and I would request ...

View answer
Does it make more sense to encrypt whole backup disk or only encrypt backup itself?
1 votes

It depends upon your level of paranoia. Short answer: all 3** Minimal answer: encrypt the backups individually Longer answer: The FS-level encryption and file-level (or backup-level) encryption ...

View answer
Is it safe to monitor java process via JMX
Accepted answer
1 votes

You can configure JMX to be exposed on the local network with SSL and various authentication methods and controls enabled. JMX will be listening on a port different from the Java application. ...

View answer
Is it dangerous to use default router admin passwords if only trusted users are allowed on the network?
3 votes

This may come off as snarky, but if you are lazy enough to not change the default password because the device is in a isolated network, what's to say someone wasn't equally as lazy in setting up this ...

View answer
Are six digit temporary numerical pins secure enough for online accounts?
3 votes

The problem with SMS as an authentication factor is that there are a number of methods to subvert it. Firstly, there are a number of design flaws in the SS7 network that allow the spoofing and ...

View answer
Did I participate in the recent DDoS attacks on Dyn's DNS service?
Accepted answer
38 votes

Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic. But there are some things you can do now to determine if you were at risk of being a participant ...

View answer
Is it illegal to DDoS a phishing page?
0 votes

Running a phishing site is typically against the TOS of the ISP. The first action would be to contact the ISP serving the site. Then contacting local law enforcement (less effective). Local this ...

View answer
Is it secure to use SQL for storing authentication codes?
0 votes

User gets redirected to a login.php page to proceed with authentication. Username and password are sent over POST to login.php and is NOT ENCRYPTED in any way. (Potential security flaw, but I'm not ...

View answer
Which type of censorship is being carried out by an ISP (in my case Airtel)?
1 votes

Your ISP is almost certainly directing you through a transparent proxy. As such, all of your web traffic is going through an intermediary set of "web servers" before going on to the site you are ...

View answer
Minimum required processes with open ports on AWS?
1 votes

I would add, that if you are running within a VPC where you define the private IP space, then you can configure your EC2 instance with a static IP and turn off DHCP as well. If you are further ...

View answer
Can the police track my phone even if I remove the SIM card?
6 votes

It depends on the method you are being tracked. If we are talking about a "wiretap," then the tracking is being done at the telco and as long as you maintain the same phone number, regardless of SIM ...

View answer
Why don't browser DNS caches mitigate DDOS attacks on DNS providers?
Accepted answer
56 votes

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...

View answer
DDoS: Why not block originating IP addresses?
3 votes

There isn't a simple or single solution to DDOS attacks, because they can be performed in lots of different ways. The nature the technology behind the Internet doesn't lend itself to anything but ...

View answer