22,936 reputation
21856
bio website
location Troy, NY
age 29
visits member for 1 year, 7 months
seen 16 hours ago

Apr
10
reviewed No Action Needed Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?
Apr
10
reviewed Leave Open Best secure way to update back-end servers?
Apr
10
reviewed Close How easy is it really to do IP spoofing?
Apr
10
reviewed Approve suggested edit on Is the Common Name mandatory for digital certificates?
Apr
9
reviewed Close How to protect JSON
Apr
9
reviewed Close Is Apache serving over HTTP vulnerable to Heartbleed?
Apr
9
reviewed Close Nexus 7: Can I set its WiFi to monitor/promiscous mode? If so, how?
Apr
9
reviewed Close How paranoid should the average user be about heartbleed?
Apr
8
reviewed Close Can ping the ip-Address but not the site and neither browse to it
Apr
8
reviewed Close Is there a TOTP variant that does not require the user to type in a code?
Apr
8
reviewed Close What are the fields needed to check for SQLI, XSS, XSRF and Remote file inclusion attacks in apache access log file
Apr
7
comment How dangerous might be publishing a public key?
@nikolasasteri - while an accurate statement, I'm not sure I see the relevance here. This question wasn't asking anything about how to encrypt data using asymmetric keys, just if it was safe to share the public key.
Apr
7
revised Is PCI Compliance mandatory?
added 17 characters in body
Apr
7
comment Is PCI Compliance mandatory?
It isn't just if you are processing and storing. Simply handling the data is sufficient to require compliance.
Apr
7
answered What was so dangerous about PGP that its creator was charged in court for it?
Apr
7
reviewed Approve suggested edit on What was so dangerous about PGP that its creator was charged in court for it?
Apr
7
comment Why do I need a certificate to pin an SSL connection with AF Networking 2?
Hmm, I do agree that that second line is suggesting getting a signed cert. My guess is that it isn't actually necessary and that they don't know how to do a trust check. I'd personally probably try to find a different library. That one seems rather limited and may have other flaws.
Apr
7
comment Why do I need a certificate to pin an SSL connection with AF Networking 2?
I don't see anything in that article you linked that indicates they are using a signed certificate. A self-signed certificate is perfectly valid, it just isn't trusted. The second paragraph seems to indicate this to be the case. It is also possible they did their own SSL implementation and didn't bother to hook in to the trusted root certificates on the device.
Apr
7
reviewed Close Privacy vs monitoring cyber crime
Apr
7
reviewed Close How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?