Humans are notoriously poor at weighing risk. We use emotion, rather than reason,…
From Password Reset Mechanisms to OpenID: A Brief Discussion of Online Password Security
For those not familiar, OpenID is a system that allows you to sign in to multiple…
Federated ID, OpenID, and OAuth: A Web Authentication Primer
Federated ID Federated ID, also called Federated Identity Management (FIM), allows…
Ruby: Parsing an IP List to Send to IpInfoDB
The code below does the following: Read a list of IPs Send each line (IP) to the…
Redirecting a Domain Using .htaccess
Here’s how to redirect from one domain to another within Apache using .htacess.…
Getting IP Location Information in Wireshark
Laura Chappell just posted a great tutorial on getting GeoIP working with the…
Installing the Latest Version of Nmap Using Subversion
As of the last year or so my preferred method for installing and updating nmap…
Wireless: WPA2 Enterprise Integration With Active Directory 2008 Using NPS
So I finally got my Wireless Access Point (an Apple AirPort) authenticating off…
Discussion: Where’s the Best Place For Country Blocks?
In a scenario where your SMB or enterprise gets constantly bombarded (portscans,…
Use Splunk as Your Remote Syslog Server
So I’ve been messing with Splunk> a bit recently, and as part of that I’ve…
A Simple Script for Harvesting DNS, Country, State, and City Information From a List of IP Addresses
My buddy at work asked me if I could find some location information for a list…
10 Essential Firefox Plugins for the Infosec Professional
I’ve moved to Chrome and Safari as my primary browsers, but nothing compares…
Verisign VIP for Two-Factor Authentication, and PIP for OpenID
I’ve been using Verisign VIP for a while now with a hard token like the…
How to Get Around the md5sum Carriage Return Issue
There’s an issue with md5sum where it returns unexpected results due to…
Why Religion is More Dangerous Than Handguns
We’ve been debating agnosticism and atheism here for the last couple of…
The Problem With Selling Information Security as a “Business Enabler”
A random, innocent tweet by Gunnar Peterson (@oneraindrop) got me emoting about…
On the Cisco / Brock Lesnar Analogy
So a fellow infosec buddy of mine, Hoff, wrote a great piece about how Brock Lesnar…
The Cloud: Reducing Security To Way Above Where It Is Today
I was just reading a good post over at securosis by my friend Rich Mogull, and…
The Nmap / DShield Trick
A while back during a pentest my buddy Steve came up with a cool idea for doing…
Windows is IE, OS X is Firefox
Many are wondering how OS X will fare against malware once it becomes a serious…
Why Some Businesses Require You to Sign Your Credit Card Receipt and Others Don’t
Many people wonder why some businesses require them to sign a receipt when they…
2 SSH Brute-Force-Attack Countermeasures
SSH attacks are in the news again, this time due to new bot-based, distributed…
Basic GPG Commands
I hate forgetting things. Here are a few GPG commands for doing the basics from…
Entering the “Cloud Security” Fray
I’ve not spent a lot of time thinking about this, but here’s how the…
A Crazy Idea Regarding the Obama Administration and Security
I have a wicked crazy idea. What if we in the information security community were…
