530 reputation
17
bio website michaelhendrickx.com
location Dubai, United Arab Emirates
age 32
visits member for 1 year, 9 months
seen 8 hours ago

Entropy isn't what it used to be.


16h
comment Secure Custom Registration Links
I think that's what he meant with the "site.com/very-long-random-nonce"; it could still be intercepted though.
1d
answered Secure Custom Registration Links
Apr
6
answered Strange Apache access logs
Apr
1
comment Hardware-restricted root login
There's a PAM module for this: pamusb.org. It allows 2 factor authentication with a USB dongle.
Mar
31
comment Storing database password in application
I was merely talking about the stored passwords, as the question indicated. I should've added encryption for data in transit, but didn't think that was the question.
Mar
30
comment HTTP/HTTPS on the same site
SSL merely implements confidentiality, data integrity and authenticity, this is challenged by MiTM. Attacks against websites will remain to exist, regardless of SSL. Oh, and the client can be also be hijacked, etc.
Mar
30
comment HTTP/HTTPS on the same site
Anybody who sits between your machine and the target site can be an attacker. This can range from network admins / proxy admins (also at the website's end), ISP's and governments.
Mar
30
answered HTTP/HTTPS on the same site
Mar
29
comment Verifying integrity of text files
That would mean a source code audit. Tools such as IBM's appscan exist to help you with this task.
Mar
29
answered Verifying integrity of text files
Mar
27
comment Do I keep my PHP simple auth session secure enough?
If your user remains "logged" in, and goes to another IP address (wifi <-> 3g, or renewed his external IP, ....), or when he upgrades the browser, you'll end his session?
Mar
25
answered How to detect the “Hello packets” sent by a wifi enabled smartphone
Mar
19
comment Is there a difference between GET and POST for web application security?
In technologies such as REST
Mar
18
awarded  Critic
Mar
17
comment Separation of secure login steps
Sorry to be such a pain, but can you define "entered". Is there any data submitted to the server?
Mar
17
comment Separation of secure login steps
"only revealed when [...] have been entered". Do you when they are entered on the client side, or submitted to the server?
Mar
17
comment How to react when under attack
I think log files could give you an indication whether the attackers are after a particular thing, or just want to deface you. Taking the site offline might just be delaying the execution, and it affects your legitimate users.
Mar
13
answered Detect blocked reverse shell
Mar
12
comment Security checks on file transfer
Depends if he wants more than just integrity checks, such as confidentiality.
Mar
12
awarded  Commentator