512 reputation
212
bio website
location Alphen aan Den Rijn, The Netherlands
age 54
visits member for 2 years, 9 months
seen Jun 10 at 12:09

Software developer at TimeTell BV, The Netherlands


Jun
9
revised How can I know that developers will be ethical and not record my password in plaintext
Made text better to understand
Jun
9
suggested approved edit on How can I know that developers will be ethical and not record my password in plaintext
Jun
2
comment Random URL string: What kind of attack is this, and what can be done to stop it?
@levelonehuman If you find out more I suggest you write an asnwer to your own question (or at least make an edit to your question).
Jun
2
comment Random URL string: What kind of attack is this, and what can be done to stop it?
If you Google for inurl:"x(1)s" you'll see that there are obviously many systems using this pattern (I get 11 million hits). This would indicate it is not 'just' fuzz testing. Many of them lead to .aspx pages. I don't know enough of these, but maybe this is a starter for an answer from someone more knowledgeable.
Jun
1
answered Where can I find a description list for major vulnerabilities?
Apr
30
comment Are these access.log entries successful wordpress login attempts?
One thing I imagine you could do is monitor new WP users - I can imagine someone getting in immediately creating a backup account. But this is no guaranteed way, of course, and will not work if you allow registrations. At least it's something, and there's probably already a mechanism or plugin for warning you.
Apr
30
comment How to check if my usb drives are vulnerable by BAD USB
Mark pointed out that only one chip type is vulnerable Only one? Can you edit and add a reference link?
Apr
30
comment How to check if my usb drives are vulnerable by BAD USB
Adam Caudill and Brandon Wilson demonstrated Bad USB at Derbycon and put their exploit kit up on GitHub. Maybe you can use that code or someone develop a tester based on it?
Apr
30
comment Are these access.log entries successful wordpress login attempts?
@user4668401 Any logins - how would you distinguish the valid ones from the succesful hacks?
Apr
16
comment Why is my Positive SSL certificate deemed insecure by Google Chrome?
Actually, there is nothing wrong with SHA-1 certificates yet. Google decided to pre-emptively build this into Chrome. It would've been the smart move to start these warnings for the same cutoff date as Microsoft does (1 January 2017), but these two are not the best of friends it seems.
Feb
6
comment I can't access websites that use HTTPS, instead getting the message “your connection is not private”!
Could also be that the ISP wants to inject Javascript into all traffic instead of just HTTP, for tracking and advertising purposes. ISP in the US are doing that. Just as bad IMHO
Jan
27
revised Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?
General cleanup
Jan
27
suggested approved edit on Long character sequence in first string of HTTP GET request breaks the web service's HTTP response. Buffer overflow?
Jan
22
answered Knowing when there has been a data breach from your database
Jan
6
suggested rejected edit on Is forcing users to use a strong password effective?
Jan
6
comment Is forcing users to use a strong password effective?
Your scheme would prevent me from using a stronger password than what you sypply (e.g. a 20 char generated Lastpass password). You would receive a strongly worded email if I was one of your users.
Dec
31
comment Does cynicism have a valid role in information security?
"to always assume that the credentials have been compromised" is not cynicism (check the dictionary). I suggest you edit your question and use a different term. Paranoia maybe?
Dec
18
comment Things to remember while building a password manager
Download and read about the ones that already exists, like KeepPass or Password Safe
Nov
27
comment Using unique email address for online signups?
A technique that people sometimes use in order to have not too many (to remember/store) email addresses: use separate addresses for important logins, use one for the many other less important sites (forums, blogs...)
Nov
15
comment Is SHA1 weak for SSL?
Extended discussion about the Google move in Security Now ep. 473 grc.com/securitynow.htm