Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
1 7
Newest
 Constituent
Impact
~9k people reached

  • 0 posts edited
  • 3 helpful flags
  • 77 votes cast
1d
comment Could keystroke timing improve security on a password?
"Easy to intercept/replicate" and "easy to forget" is pretty much two of the worst features for a password.
Apr
25
comment Is exposing exception information in web service a security risk?
Stack trace is just as useless for API consumer as it is for UI user. He does not have access to source code.
Apr
20
answered How can mom monitor my internet history from a distance?
Feb
4
answered How do web email clients store my passwords from other providers?
Jan
18
revised Can I simply search-replace < and >?
added 451 characters in body
Jan
17
comment Can I simply search-replace < and >?
@immbis, You don't quote anything in message in some pre-defined format. You use encoding function that take language-native object and get some message buffer.
Jan
17
comment Can I simply search-replace < and >?
@immibis, I don't even get what you're talking about - there's no such thing as "unescaped JSON".
Jan
16
comment Can I simply search-replace < and >?
@immibis, also, it is appropriate and ONLY correct solution. You must stop mixing markup/templates and data to stop any chances for later to be interpreted as former. Nobody argues that SQL binding is only correct way, despite it too bringing small overhead by transmitting field values separately instead of embedding them directly into text query.
Jan
16
comment Can I simply search-replace < and >?
@immibis, did you actually used id? I used it on several multi-billion hit-per-day sites without any problems (browser gaming/BMMO and RTB) in several different languages. Thanks to it's simplicity it is lightning fast in most implementations I've seen for different languages.
Jan
16
comment Can I simply search-replace < and >?
@BenoitEsnard, use JSON array. JSON is single context with much less corner cases than entire HTML. In pretty much any language you can just call encode_json on native array and be done with it. But no language have same for HTML because it is much more complex.
Jan
16
answered Can I simply search-replace < and >?
Jan
15
comment Windows XP has many security vulnerabilities, So why many bank using Windows XP until now?
@EricG, you don't need connection "to the world" for this. Only point-to-point connection to single secure machine that monitors ATMs and distributes patches. This automatically eliminates problems with pretty much any remote vulnerability unless that secure machine itself is compromised.
Jan
14
comment Response to unauthorized scan by legit company?
Use it as advertising: "CompanyName ran a surprise pentest and couldn't find any problems."
Jan
14
comment Why do some internet banks force logout on back button?
This bank have problems starting from the words "cached version".
Jan
13
comment Bitcoin and criminals
Don't forget about existence of en.wikipedia.org/wiki/Cryptocurrency_tumbler though.
Dec
30
comment What is the best way to encrypt a json object in Java?
1) Searilze it with whatever method you like, preferer those with smallest output and built-in compression. 2) Compress if no built-in compression was used. 3) Use whatever your favorite strong encryption library on resulting buffer.
Dec
28
comment How do large companies protect their source code?
If closed source is the only things that prevents you from vulnerabilities, then I have bad news for you.
Aug
20
comment Password strength of random words and brainflayer
Password length does NOT need to scale. Only strength of encryption and processing required to check one guess, because you don't bruteforce passwords, you bruteforce their hashed/encrypted form.
Jul
28
awarded  Constituent
Jul
28
awarded  Caucus