149 reputation
5
bio website
location
age
visits member for 1 year, 7 months
seen 21 hours ago

Jan
3
comment iptables: plaintext password protection
Bad idea. A script can try to send all possible combinations of your password to a server. The missing password is yours.
Dec
30
comment Can malicious code be contained outside the filesystem on a USB drive?
Yes
Nov
27
awarded  Commentator
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
The preflight request is only send for request that you could not send otherwise, e.g. you can always add a form with hidden elements and submit it via JS.
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
Wrong. If the script requests that cookies are send, they are send, but if the Access-Control-Allow-Credentials response header is false or missing, the script would not get the response.
Nov
27
comment Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
In this case Access-Control-Allow-Credentials: true does not make a difference.
Nov
27
revised Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
added 266 characters in body
Nov
27
answered Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *)
Oct
28
comment Preventing XSS for REST API
I've written such an API a long time ago, the solution for xss is simple: createTextNode.
Oct
28
comment Is “Small HTTP server” malware?
And again AV scares all customers away from a legitimate product just because some people use the ̶t̶o̶o̶l hammer to destroy cars.
Oct
25
awarded  Critic
Sep
12
comment Is it possible to inject values in a drop down list?
Or use firebug.
May
12
comment XSS via Unicode
A bad idea to setup the browser that way, but I'd say that is nothing you can prevent. (And very hard/impossible for an attacker to force that).
May
12
comment XSS via Unicode
@user85030 see the wiki page for UTF-7. An other problem is that an attacker could send a invalid sequence (\700\600 instead \000), that an other side interprets as the NULL char. Ohh, I forgot: many characters can be encoded with different sequences, so the Umlauts: as single codepoint or as a with two dots over it. (2 codepoints)
May
12
comment XSS via Unicode
@user85030 Because it can decode the attack <script src="..."> correctly. And that is all what matters for XSS.
May
11
answered XSS via Unicode
Feb
14
awarded  Teacher
Feb
14
awarded  Editor
Feb
14
revised What is the point of hashing passwords?
added 405 characters in body
Feb
14
answered What is the point of hashing passwords?