29,060 reputation
23073
bio website
location Troy, NY
age 30
visits member for 2 years, 1 month
seen 6 hours ago

Oct
9
comment What actually happens in “low voltage fault attacks”
Yeah, if you could provide your own power supply or check on the power level in a way that it can't be tampered with without making it detectable, it would effectively counter the covert portion of this attack, though it wouldn't prevent the leakage, so it doesn't prevent the success of the attack, just allows for it to be detected. The more proper fix is to correct the faults in the algorithm that allow for the leakage (if possible).
Oct
9
answered How safe is it for an app to trust a click on a link in an email?
Oct
9
comment How safe is it for an app to trust a click on a link in an email?
@ThoriumBR - the idea is that the token should be of limited usefulness. It shouldn't allow unlimited posting.
Oct
9
answered What actually happens in “low voltage fault attacks”
Oct
8
awarded  Nice Answer
Oct
8
answered How does SSO enhance security?
Oct
7
reviewed Close Reconnaissance countermeasures
Oct
6
reviewed Close How do I respond to a spam server that invalidates my tokens?
Oct
3
reviewed No Action Needed Odd requests to health_check.js show up in Fiddler
Oct
3
reviewed Close Why can't a cryptographic hash inside a cryptogram serve as a MAC?
Oct
3
reviewed Leave Open Do I need a bachelor's degree to break in information security?
Oct
3
reviewed Approve suggested edit on Why “() { :;};”?
Oct
2
answered How does credit card authorization work
Oct
1
reviewed Close How can we represent SSL and Firewall in OSI Model?
Sep
30
awarded  Explainer
Sep
30
reviewed Close I want to encrypt content on USB or SD Card
Sep
30
reviewed Leave Open Burp configuration to allow SSL connection
Sep
30
reviewed Close Does client certificate do any encryption in https connection?
Sep
29
comment Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?
@Dr.McKay - that's the thing though, the place to do that is in the certificate. If Cloudflare is putting up certificates that don't make the state of the connection clear, then they should be stripped of trust until they fix the problem, just like we'd strip any other major misbehaving CA of not behaving in a trustworthy manner. That is how the SSL system is designed to operated, we don't need some new solution to a problem that is already solved.
Sep
29
answered Now that CloudFlare offers potentially-insecure free SSL to all users, would a new HTTP header be useful?