23,765 reputation
755113
bio website infosecstudent.com
location Singapore
age 19
visits member for 2 years, 2 months
seen 45 mins ago

Currently a student studying IT security.


Jan
15
comment How to store passphrase in this situation?
You still need to provide more information. Is the app in question a desktop app or something that will be running in a JEE app server? App servers do provide a fairly robust means of storing such passwords.
Jan
6
comment Sharing login session from one website to another?
en.wikipedia.org/wiki/Single_sign-on
Jan
2
comment Custom rest api / client security scheme
@user36581 No, why pass hashed passwords? Hash them on the server side.
Dec
28
comment Is there any useful Android app for security assessments?
"I have seen a couple of non-closed questions about recommended books" In general, those are old questions during the site's infancy where the rules are less strict. Nowadays, such questions would be considered "product recommendation" questions and I have voted to close this as such. :)
Dec
24
comment Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Good points, but that last one can be (somewhat) mitigated by not allowing password-based logins.
Dec
23
comment Considerations for security release notes
What is your "product"? An actual installable piece of software? A web app?
Dec
23
comment Buffer Overflow on Raspberry PI
@Gilles "All devices running OSX..." I might have missed something but... what?
Dec
20
comment Should an administrator be able to turn off TFA for a user
@AntonAnsgar That can be done automatically through something like email a link to the user.
Dec
19
comment Bcrypt SHA-256 implementation
Yes, but that's the only way to get a 256 bit value from a bcrypt output. Use PBKDF2 if you want a tunable output length instead.
Dec
19
comment RSA key recovery using sound - How does it work?
@Gilles What Rohan said. The paper is actually an improvement on a previous paper. cs.tau.ac.il/~tromer/papers/tromer-phd.pdf
Dec
19
comment Bypass Nmap Scans Being Blocked
This question is very difficult to answer without more information about the actual setup. The "hidden" machine could be on a subnet that's only accessible from one of the machines which will require you to root it and tunnel traffic through it.
Dec
17
comment Challenges in authentications
@user2315 Thomas Pornin says otherwise. security.stackexchange.com/a/3213/10211
Dec
17
comment Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?
"Devices and tokens that implement TOTP (Yubikey, Google Authenticator app) are designed to protect the secret key against extraction." - Not true. The Google Authenticator app merely stores the key in an sqlite database.
Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
download.fedoraproject.org/pub/fedora/linux/releases/19/Live/…
Dec
14
comment Does an email signature increase security?
I assumed you meant "PGP" instead of "PHP" so I went ahead and edited it. :)
Dec
12
comment what is mXSS? anyone knows?
@cengizUzun I can't recall, but I think yes, if the textarea in question is being used by code calling .innerHTML
Dec
12
comment what is mXSS? anyone knows?
@Rook Heh, the "m" actually stands for mutation. :P
Dec
10
comment Questions on IDS, IPS, VLANs and VPN
Way too many completely unrelated questions here. Voting to close this as "Too broad".
Dec
2
comment Why is always possible to discover and exploit new zero-day vulnerabilities?
@Matrix Sandbox escapes and priv escalation vulns are available for almost every platform out there given enough cash. Sure, you can lock down a single server very tightly but then in most cases you limit the usefulness of said server. This answer is correct, it's a risk management thing.
Nov
29
comment Force a specific SSL cipher
Yes, this tool is called Python (or scripting language of choice.)