8,759 reputation
21457
bio website
location The Netherlands
age
visits member for 3 years
seen 1 hour ago

Student; manufactured 2 decades ago; interested in computer security and software engineering.


Apr
22
revised Will http only cookie work while using chrome bandwidth saving feature in Android?
additional tags for clarification
Apr
21
reviewed Approve Field-level encryption vs disk encryption for PCI compliance
Apr
21
reviewed Approve Is Google Drive security compromised?
Apr
21
reviewed Approve What security mechanisms are used in BGP and why do they fail?
Apr
20
reviewed Reopen Are there “secure” languages?
Apr
19
reviewed Approve Is there anything standing in the way of email encryption going mainstream?
Apr
18
comment Booting into Live USB Linux
@oshirowanen Your normal computer might have a virus to alter the USB stick's contents, that's why. Usually not the case I guess, but again, if you're talking about "usually" then much of the advice in my post can be disregarded.
Apr
18
revised Booting into Live USB Linux
added 124 characters in body
Apr
18
answered Booting into Live USB Linux
Apr
18
reviewed Approve What makes it illegal to use the information learned by exploiting a bug?
Apr
17
reviewed Approve How do you identify a website's form-type?
Apr
15
reviewed Approve How to explain Heartbleed without technical terms?
Apr
13
reviewed Approve Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?
Apr
12
reviewed Approve How to identify and analyze malware that checks for security tools before running?
Apr
11
comment Is Apache serving over HTTP vulnerable to Heartbleed?
@David Hmm, I'm not sure heartbleed+ssl/tls is better than no ssl/tls at all... I have first hand experience exploiting both and you're right that they're both awful, but the impact of http is usually much lower. Of course in different situations things might be different, but generally I think you're much better off disabling https altogether if the alternative is to leave it vulnerable.
Apr
11
comment API to change passwords?
@SteveS because then you rely on a central authority that is a single point of failure in availability and can also impersonate you. And as for multifactor: well you're down to one factor if your password leaks. Perhaps the second protects you for a while, but it was two factor for a reason.
Apr
11
reviewed Approve Heartbleed - Read only the next 64k and hyping the threat
Apr
11
reviewed Reject How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
Apr
11
comment Is Apache serving over HTTP vulnerable to Heartbleed?
@David, Actually, I think your comment is flawed :P. What you're saying is: "even with this bug, an attacker needs to be savvy enough to exploit it, whereas http can always be read in plaintext". There is a huge distinction here: with this bug you can read anyone's data from the RAM if you get a bit lucky, even the server's (i.e. its private key). With http you can only read the data from whomever's network traffic you can see. If http was equal to the heartbleed bug, we'd have banned plain http a long, long time ago (though, for different reasons, we should, and are in http v2.0).
Apr
11
revised Exploiting HTTP content in HTTPS page
Updated and clarified