Reputation
11,786
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
2 18 66
Newest
 Nice Answer
Impact
~681k people reached

Jul
28
comment A DDOS attack by uploading a few hundred large files - whats stopping anybody?
I think the question if off-topic here. It's a very simple math formula how many clients can upload data to you at the same time, so the question is how to write code (or configure your servers) such that the system throttles clients when there is too much data. I think this question is more fit for StackOverflow (if you want to solve it with code) or Serverfault (if you want to solve it with configuration).
Jul
27
accepted What's this kind of authentication scheme called?
Jul
27
asked What's this kind of authentication scheme called?
Jul
26
comment Why aren't application downloads routinely done over HTTPS?
@DamonGant What do you mean "that includes twitter"? Manually going to twitter.com in a private navigation window (no cookies or other cache) automatically redirects me to https (which is TLS, as I guess you know). And the browser checks the certificate's signature. So I don't understand what you mean.
Jul
21
reviewed Close Ways to protect source code from theft
Jul
21
comment Ways to protect source code from theft
I find this question valid (it's being voted to be closed as "unclear what you're asking"), but it sounds very similar to this one: security.stackexchange.com/questions/17276/…. There it's about any data, but source code is also private data really.
Jul
18
awarded  Synonymizer
Jul
13
revised Exploiting HTTP content in HTTPS page
added 547 characters in body
Jul
13
revised Exploiting HTTP content in HTTPS page
added 965 characters in body
Jul
13
revised Exploiting HTTP content in HTTPS page
added 439 characters in body
Jul
13
revised Exploiting HTTP content in HTTPS page
added 1574 characters in body
Jul
13
revised Exploiting HTTP content in HTTPS page
added 1173 characters in body
Jul
13
answered Exploiting HTTP content in HTTPS page
Jul
13
comment Exploiting HTTP content in HTTPS page
@Close voters: If this is too broad then "How does SSL work" should be removed from this website right now. Another close vote type might be applicable, but I don't think the question is too broad.
Jul
13
reviewed Leave Open Exploiting HTTP content in HTTPS page
Jul
13
reviewed Close Which IP address in email headers is the sender's?
Jul
13
comment Is it possible to set up my own VPN using an ISP without having to open a 3rd party VPN account?
I don't understand your question, but I don't know what to ask really, it's rather vague... Like aRun said, what cloud do you even mean? And why would you even need your ISPs permission/cooperation to connect to that VPN?
Jul
10
comment Is there a security reason for a site to limit the number of times a user can change their password?
@TobiasKienzler What does that have to do with this?
Jul
10
comment Is there a security reason for a site to limit the number of times a user can change their password?
Well I guess there is no point in commenting this here, but limits like these are just so annoying. In general I'm very much for burst rates: let the user change the password three times in 72 hours. You can't get back to the original any faster than you can with 1/24h, but at least you can correct something if you've made a mistake (capslock on or whatever)...
Jul
10
comment Is there a tool to verify browser TLS/SSL configuration
@dfc From the speed and number of requests the browser makes, I'd guess that the info is what the browser sends upon connecting. The browser tells the server "hey I wanna setup SSL/TLS and support the following: x, y, z. What's it gonna be?" This website then displays back to you what the browser offered to use. So it's not "only those that the server probed for" but the other way around. See also the second sentence of the "high level description" in this post of mine: security.stackexchange.com/a/20833/10863