Reputation
28,277
Next tag badge:
91/100 score
19/20 answers
Badges
9 73 141
Newest
 Nice Answer
Impact
~1.5m people reached

Jan
15
comment What is the ultimate goal of hacking a webserver?
@Hless Simple enough things like affiliate links or getting hired to send spam about certain topics. Renting out botnets for various activities are very profitable.
Jan
15
comment What kind of dictionaries can be created from a normal dictionary?
"What other converting methods exists in the world?" There is literally no end to the answers you can receive....
Jan
15
comment How to store passphrase in this situation?
You still need to provide more information. Is the app in question a desktop app or something that will be running in a JEE app server? App servers do provide a fairly robust means of storing such passwords.
Jan
6
comment Sharing login session from one website to another?
en.wikipedia.org/wiki/Single_sign-on
Jan
2
comment Custom rest api / client security scheme
@user36581 No, why pass hashed passwords? Hash them on the server side.
Dec
28
comment Is there any useful Android app for security assessments?
"I have seen a couple of non-closed questions about recommended books" In general, those are old questions during the site's infancy where the rules are less strict. Nowadays, such questions would be considered "product recommendation" questions and I have voted to close this as such. :)
Dec
24
comment Do simple Linux servers really need a non-root user for security reasons?
Good points, but that last one can be (somewhat) mitigated by not allowing password-based logins.
Dec
23
comment Considerations for security release notes
What is your "product"? An actual installable piece of software? A web app?
Dec
23
comment Buffer Overflow on Raspberry PI
@Gilles "All devices running OSX..." I might have missed something but... what?
Dec
20
comment Should an administrator be able to turn off TFA for a user
@AntonAnsgar That can be done automatically through something like email a link to the user.
Dec
19
comment Bcrypt SHA-256 implementation
Yes, but that's the only way to get a 256 bit value from a bcrypt output. Use PBKDF2 if you want a tunable output length instead.
Dec
19
comment RSA key recovery using sound - How does it work?
@Gilles What Rohan said. The paper is actually an improvement on a previous paper. cs.tau.ac.il/~tromer/papers/tromer-phd.pdf
Dec
19
comment Bypass Nmap Scans Being Blocked
This question is very difficult to answer without more information about the actual setup. The "hidden" machine could be on a subnet that's only accessible from one of the machines which will require you to root it and tunnel traffic through it.
Dec
17
comment Challenges in authentications
@user2315 Thomas Pornin says otherwise. security.stackexchange.com/a/3213/10211
Dec
17
comment Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?
"Devices and tokens that implement TOTP (Yubikey, Google Authenticator app) are designed to protect the secret key against extraction." - Not true. The Google Authenticator app merely stores the key in an sqlite database.
Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
download.fedoraproject.org/pub/fedora/linux/releases/19/Live/…
Dec
12
comment What is mutation XSS (mXSS)?
@cengizUzun I can't recall, but I think yes, if the textarea in question is being used by code calling .innerHTML
Dec
12
comment What is mutation XSS (mXSS)?
@Rook Heh, the "m" actually stands for mutation. :P
Dec
2
comment Why is always possible to discover and exploit new zero-day vulnerabilities?
@Matrix Sandbox escapes and priv escalation vulns are available for almost every platform out there given enough cash. Sure, you can lock down a single server very tightly but then in most cases you limit the usefulness of said server. This answer is correct, it's a risk management thing.
Nov
29
comment Force a specific SSL cipher
Yes, this tool is called Python (or scripting language of choice.)