meta user
network profile
| bio | website | lucb1e.com |
|---|---|---|
| location | The Netherlands | |
| age | ||
| visits | member for | 11 months |
| seen | 3 hours ago | |
| stats | profile views | 210 |
Application development student. Also interested in computer networking and security. See also: lucb1e.com/!about
|
Nov 2 |
comment |
Use HTTP POST for Google Search queries @ponsfonze And how exactly would he do that? |
|
Nov 1 |
comment |
Is it necessary to scan users' file uploads by antivirus? Good suggestion to convert files first, but I think that doesn't work in this case. There is no way you could do this for all possible filetypes. |
|
Nov 1 |
comment |
Is it necessary to scan users' file uploads by antivirus? In case 1, beware of pranksters submitting EICAR and then having the download get rated by their anti-virus program. All alarm bells probably go off and your domain is blocked for everybody using that AV, or at least that happened to me once... Only I uploaded it myself so I wouldn't have to look EICAR up all the time. I figured I'd better move it to a private directory :P |
|
Nov 1 |
comment |
Use HTTP POST for Google Search queries @Jeshurun Glad I could help! To continue about https a bit: it actually encrypts everything on the connection. No matter if it's GET, POST, PUT (you won see that a lot), or anything else that HTTP supports. It will encrypt the request (URL with headers - headers contain things like what browser you are using), any additional data like POST-data, the response headers, and the response content. Sometimes images or so will be loaded unsecurely and make it give a mixed-content warning, but the page itself (the HTML) will always be secure with HTTPS. So just using that you're probably good :) |
|
Nov 1 |
revised |
Use HTTP POST for Google Search queries added 100 characters in body |
|
Nov 1 |
answered | Use HTTP POST for Google Search queries |
|
Nov 1 |
comment |
Who is responsible for the strength of user's passwords? Interesting suggestion about the forced-password-change policy, but I wonder if it would really work to make things more secure or if it just creates more problems. People might choose especially weak passwords such as the week's number, or use a secure one and write it down, to name two things off the top of my head. |
|
Nov 1 |
comment |
Who is responsible for the strength of user's passwords? With that kind of logic I could blame the state for driving against a tree. Who put that tree there! Who put that road so close to the tree! Also your answer is rather short and subjective. |
|
Oct 31 |
awarded | Nice Answer |
|
Oct 30 |
revised |
Parabolic Denial Of Service — Would it work? 0.0.0.0 is a network and not an unicast address, thought this would be clearer |
|
Oct 30 |
revised |
Limited JavaScript app scenario: Attack vectors and mitigation added 298 characters in body |
|
Oct 30 |
answered | Limited JavaScript app scenario: Attack vectors and mitigation |
|
Oct 30 |
comment |
How does syskey in Windows increase the security in a domain? @GrahamHill Encrypting it with a decent password in winrar, whynot? |
|
Oct 29 |
revised |
CSRF Protection on static pages added 46 characters in body |
|
Oct 29 |
answered | CSRF Protection on static pages |
|
Oct 25 |
comment |
Good Practices to secure FTP access @MahbuburRAaman As you've pointed out yourself, FTP can be secured. |
|
Oct 25 |
revised |
Good Practices to secure FTP access Expanded with "the problem with standard ftp" and "about the measures you've taken so far". |
|
Oct 25 |
answered | Good Practices to secure FTP access |
|
Oct 25 |
comment |
Why is this certificate valid for so many domains? @jdoe Because that requires SNI, and is a rather long story. This answer on Serverfault explained it for me. If that's still not clear, let me know! Edit: And also, from a security perspective, the server would still need to know all those certificates (or at least a number of them). If you can grab one, you can probably grab all private keys stored there. |
|
Oct 24 |
awarded | Civic Duty |
