22,601 reputation
647106
bio website infosecstudent.com
location Singapore
age 19
visits member for 1 year, 10 months
seen 1 hour ago

Currently a student studying IT security.


Jan
21
comment Basic Security Knowledge
@RattleSnake That is sadly not how the Stackexchange network works. We focus on answering one specific question at a time. This isn't a traditional forum where posts can be pinned to the top of the page.
Jan
15
comment What is the ultimate goal of hacking a webserver?
@Hless Simple enough things like affiliate links or getting hired to send spam about certain topics. Renting out botnets for various activities are very profitable.
Jan
15
comment What kind of dictionaries can be created from a normal dictionary?
"What other converting methods exists in the world?" There is literally no end to the answers you can receive....
Jan
15
comment How to store passphrase in this situation?
You still need to provide more information. Is the app in question a desktop app or something that will be running in a JEE app server? App servers do provide a fairly robust means of storing such passwords.
Jan
6
comment Sharing login session from one website to another?
en.wikipedia.org/wiki/Single_sign-on
Jan
2
comment Custom rest api / client security scheme
@user36581 No, why pass hashed passwords? Hash them on the server side.
Dec
28
comment Is there any useful Android app for security assessments?
"I have seen a couple of non-closed questions about recommended books" In general, those are old questions during the site's infancy where the rules are less strict. Nowadays, such questions would be considered "product recommendation" questions and I have voted to close this as such. :)
Dec
24
comment Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Good points, but that last one can be (somewhat) mitigated by not allowing password-based logins.
Dec
23
comment Considerations for security release notes
What is your "product"? An actual installable piece of software? A web app?
Dec
23
comment Buffer Overflow on Raspberry PI
@Gilles "All devices running OSX..." I might have missed something but... what?
Dec
20
comment Should an administrator be able to turn off TFA for a user
@AntonAnsgar That can be done automatically through something like email a link to the user.
Dec
19
comment Bcrypt SHA-256 implementation
Yes, but that's the only way to get a 256 bit value from a bcrypt output. Use PBKDF2 if you want a tunable output length instead.
Dec
19
comment RSA key recovery using sound - How does it work?
@Gilles What Rohan said. The paper is actually an improvement on a previous paper. cs.tau.ac.il/~tromer/papers/tromer-phd.pdf
Dec
19
comment Bypass Nmap Scans Being Blocked
This question is very difficult to answer without more information about the actual setup. The "hidden" machine could be on a subnet that's only accessible from one of the machines which will require you to root it and tunnel traffic through it.
Dec
17
comment Challenges in authentications
@user2315 Thomas Pornin says otherwise. security.stackexchange.com/a/3213/10211
Dec
17
comment Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?
"Devices and tokens that implement TOTP (Yubikey, Google Authenticator app) are designed to protect the secret key against extraction." - Not true. The Google Authenticator app merely stores the key in an sqlite database.
Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
download.fedoraproject.org/pub/fedora/linux/releases/19/Live/…
Dec
14
comment Does an email signature increase security?
I assumed you meant "PGP" instead of "PHP" so I went ahead and edited it. :)
Dec
12
comment what is mXSS? anyone knows?
@cengizUzun I can't recall, but I think yes, if the textarea in question is being used by code calling .innerHTML
Dec
12
comment what is mXSS? anyone knows?
@Rook Heh, the "m" actually stands for mutation. :P