9,024 reputation
21558
bio website
location The Netherlands
age
visits member for 3 years, 1 month
seen yesterday

Student; manufactured 2 decades ago; interested in computer security and software engineering.


Feb
1
awarded  Custodian
Feb
1
reviewed No Action Needed Solving the code delivery problem via hashing the source GET'd
Feb
1
comment Why did Facebook not use HSTS for a long time after it became available?
"I can't think of any practical reason to disable secure browsing." I can: speed. If you only use it from home and you're the only user on the network, the security risk is negligible for most people.
Jan
19
reviewed Approve Collecting Information from CVE and MSB to write proof-of-concept
Jan
19
reviewed Approve Techniques for ensuring verifiability of event log files
Jan
13
reviewed Approve Protecting code injection via chattr on php files?
Dec
25
reviewed Approve Authenticating a Proxy server over HTTPS
Dec
20
reviewed Approve Open Problems in Security?
Dec
20
reviewed Approve DNS Cache poisioning examples, or other criteria when a client ignores a response
Dec
20
reviewed Approve What regulations *require* multi-factor authentication?
Dec
20
reviewed Approve Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)
Dec
20
reviewed Approve OWA Keep-Alive in http, even though it should be forced https
Dec
20
reviewed Approve How can I find the process that is trying to use smtp to send email?
Dec
20
reviewed Approve How does DNSSec work? Are there known limitations or issues?
Dec
14
reviewed Approve How can someone go off-web, and anonymise themselves after a life online?
Dec
10
reviewed Approve Server sends RST during TLS handshake. Why?
Dec
7
reviewed Approve How to know what others browse through the network?
Dec
4
reviewed Approve What to do about ssh breakin attempts
Dec
2
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
I'm sure this is all technically true, but talking about your self-invented 5 tiers of security does not answer the question. And disclosure would be used when you are a certificate reseller, not when you (like most of the people here I think) got a website with a (hopefully signed) certificate.
Dec
2
revised Do I need a salt when hashing a randomly generated password?
You hash the output of a CSPRNG. It's very confusing to say you hash a CSPRNG or that your password "is" CSPRNG.