347 reputation
16
bio website
location
age
visits member for 2 years, 5 months
seen Aug 23 '13 at 13:12

Jul
24
comment Is decryption using Java+JSF safer than using JavaScript?
Applet does not have to contain decryption key, it can access HSM via some secure api... That's how mainly digital signing on web based systems work, accessing smartcard reader via some dll's.
Jul
23
answered Is decryption using Java+JSF safer than using JavaScript?
Jul
16
awarded  Yearling
Jan
14
comment Is this a security flaw in Firefox 18.0?
Even if not a security flaw, it's a bug and submit it to FF's bugzilla
Jan
8
comment Using Username/Password to generate 'public' key for Encryption
If you need secure key exchenge why not use Diffie-Helman algorithm ?
Jan
8
answered What Checkstyle or Findbugs rules detect common vulnerabilities?
Jan
7
comment CSRF Countermeasures
CSRF protection token should change, preferably on every request, and for every form it should be different, and not constant in time...
Jan
3
comment How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
To extend great answer, Java uses JCA (Java Cryptographic API) to access keystores, and it's completly transparent to programmer in what format is key stored... but native support for formats is very poor, you may look into other java libs that will support this format directly, wihtout need of repackaging.
Jan
3
comment How do I verify, parse and process the results of the HTML5 keygen tag?
Also this may be helpful: lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/…
Jan
2
comment Reverse shell attack and proxy interceptions.. . is there anything worng?
@g9999 ZAP is a http "attack" proxy, made for web-apps vuln analysis.... and rev shell needs a NEW connection to your host so ZAP is not involved in your reverse connection setup. It's irrelevant. It may if you point your sploit to connect to a ZAP's port on your machine but it's pointless.
Dec
27
comment Mitigation Strategies for Response Spliting Attack
It basically strips down to preventing \n\r strings entering your header section. So i.e. in java you have addHeader method which do that kind of checks for you.
Dec
27
answered Mitigation Strategies for Response Spliting Attack
Dec
19
answered How can I use certificates to secure my webservices? What is available to javascript?
Dec
12
awarded  Citizen Patrol
Dec
12
comment Gold Standard for password hashing
security.stackexchange.com/questions/3272/…
Dec
7
answered Is it preferable to perform encryption using database functions or code?
Dec
6
answered RSA and encrypted authentication
Dec
4
comment 3 or 4 characters long username from security point of view
It can be an issue if attacker is using exaustive search, for both username and password. But it's not likely, as you mentioned you have an admin user, so attacker already knows at least one username. It will be a change in security but I don't think it's dramatic and worth all the hustle. Usernames are not secret and you should not treat them like such. Put constraints on passwords not usernames :).
Dec
4
comment 3 or 4 characters long username from security point of view
I think you should be bothered only with username duplication, and information disclosure if username already taken :) (it is not always an issue).
Dec
3
awarded  Commentator