Reputation
34,161
Next tag badge:
617/400 score
77/80 answers
Badges
2 38 91
Newest
 Nice Answer
Impact
~2.2m people reached

Apr
21
reviewed No Action Needed What's the down side of a dynamic numbered radial keypad?
Apr
21
reviewed No Action Needed texting password reset link instead of a code
Apr
21
reviewed No Action Needed Google Drive photo security and publicly visible lh*.googleusercontent.com
Apr
21
reviewed Reject Metadata leakage from security camera upload times
Apr
21
reviewed Close Search string in memory within GDB
Apr
21
reviewed Leave Open Recent hack appends to all javascript files
Apr
19
revised How can I recover from a hacked WordPress site and prevent future attacks?
added 92 characters in body
Apr
19
awarded  Nice Answer
Apr
19
revised How can I recover from a hacked WordPress site and prevent future attacks?
added 304 characters in body
Apr
12
comment PCI-DSS Is the infrastructure really in-scope?
@motivated That is a fair point. Whoever has a merchant account is responsible for making sure they use it appropriately, however using a third party means your systems don't need to be, you just need to verify your vendor is compliant which generally just means checking their certification.
Mar
14
revised When should I use symmetric encryption instead of RSA?
added 23 characters in body
Mar
14
comment When should I use symmetric encryption instead of RSA?
@Aerovistae - I would point to the selected answer on that post as a source. Part of the issue may be a misunderstanding of how I used the term, which may have been slightly overly simplified. I updated my answer to clarify that I meant "for a given bit length". You need larger keys when your keys are related to each other to maintain security where as a symmetric key doesn't give anything away about itself.
Mar
14
revised When should I use symmetric encryption instead of RSA?
added 23 characters in body
Mar
13
awarded  Nice Answer
Mar
10
comment What risks are there with a Bluetooth based door lock, and are there any mitigations?
As a personal addendum. I did eventually decide to make use of Shlage's smart deadbolt. It isn't bluetooth based specifically, but while the concerns of compromise of the automation system are a factor, the chance of someone simply picking or bumping the lock are a much greater threat than a technically sophisticated attack when compared to the ability to remotely verify the locked condition of my door and remote open for authorized visitors. (I'm also making use of a video doorbell for secure identity verification.)
Mar
3
comment Webpage sent me my password in clear text can it be secure?
@user1587439 the op stated that this was years after the initial registration. Yes, sending a new password on reset does not mean it is stored(though it is still bad practice), but sending an old password long after creation does.
Feb
25
awarded  password-management
Feb
24
awarded  Nice Answer
Jan
27
awarded  Good Answer
Jan
13
comment Why not allow spaces in a password?
@DanHenderson - indeed, the 4 word phrase is certainly more secure than just one word in terms of guessing. The risk is that most people will realize "teapot" isn't secure, but they might not realize that "I'm a little teapot short and stout" really isn't that much more secure. Giving someone the illusion of security can be very dangerous from a user's perspective. That said, I don't thing a "no space" policy does much to actually accomplish that, but it's literally the only reason I can think of that someone might try to limit it. Unfortunately ineffective but well meaning policy is common