meta user
network profile
| bio | website | ladadadada.net |
|---|---|---|
| location | London, United Kingdom | |
| age | 32 | |
| visits | member for | 2 years, 4 months |
| seen | 29 mins ago | |
| stats | profile views | 139 |
I'm an Australian by birth but currently live in London. I'm a traveller at heart and I love seeing how different the rest of the world is. I'm always up for something new and interesting.
I've been playing with computers pretty much my whole life, working with them since 2000 in tech support and programming and as a full-time Sysadmin since 2006. I've been fascinated by security since about 2003 and I tend to become the default "security guy" at most places I have worked.
I enjoy all forms of sport and outdoors activities but particularly cycling, hockey, sailboarding, snowboarding, camping and Frisbee. I'm also passionate about the environment, growing my own food, cooking it and eating it.
|
Apr 6 |
comment |
get vs post which is more secure? Submitting a password field using GET would also circumvent the shoulder surfing protection that is normally provided by browsers. |
|
Apr 6 |
answered | Any tool for scanning vulnerabilities in browser extensions? |
|
Apr 6 |
comment |
Any tool for scanning vulnerabilities in browser extensions? Plugins and extensions are different things (at least in Firefox). For instance, Flash and Java are plugins, Adblock and NoScript are extensions. I suspect Qualys are only talking about the former. |
|
Apr 5 |
comment |
Security seals and the “perception of safety”? EV certificates allow you to tell the difference between whitehouse.com and whitehouse.gov ... or it would if either www.whitehouse.gov or whitehouse.gov had a valid SSL certificate. (They're different certificates too). The also allow you to tie a physical company you're used to such as your bank to a website owned by the same company. Not that even 0.1% of users would actually do this. |
|
Apr 4 |
awarded | Enlightened |
|
Apr 4 |
awarded | Nice Answer |
|
Apr 4 |
reviewed | Reviewed What are the security threats of zip file uploads and what preventive actions should be taken? |
|
Apr 4 |
revised |
Preventing Voter Fraud on a Social Media Contest added 65 characters in body |
|
Apr 3 |
comment |
Is it the default in billing systems to send out the users password by email? The standard option for you at this point is to attempt to publicly shame them into fixing their security mistakes. You should make a serious effort to convince them privately, but once the time limit is up, go public. This is known as responsible disclosure. Here's Troy Hunt doing exactly that earlier today. |
|
Apr 3 |
answered | Preventing Voter Fraud on a Social Media Contest |
|
Apr 3 |
comment |
Preventing Voter Fraud on a Social Media Contest Related question: security.stackexchange.com/questions/33447/… It looks like Facebook at least already do their own multiple-account detection and that it's non-trivial to bypass. I suspect Twitter do something similar but that they would be more tolerant of multiple accounts as long as they are not spamming. |
|
Apr 3 |
answered | I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help? |
|
Apr 3 |
comment |
I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help? I'm curious why your client is worried about DDoS attacks. Is there a controversial aspect to the site? Is it likely to attract unwanted attention? Have they had this happen to them before or are they just paranoid after reading all the "Internet is doooooomed!" articles about Spamhaus and Cyberbunker recently? |
|
Apr 3 |
revised |
I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help? Spelling/capitalisation. |
|
Apr 3 |
answered | What typically is the expiration date of a session cookie? |
|
Apr 3 |
comment |
Using SSL Certification in Multiple Locations Cross posted at serverfault.com/questions/495771/… |
|
Apr 3 |
awarded | Informed |
|
Apr 2 |
comment |
How much are security tools audited? It would seem to me that the very people who use Backtrack or Kali are the people most likely to detect that their machine started behaving maliciously after using it, for instance by having egress logging on their network firewall. If I were trying to sneak malicious code into an open source project, I would target something else. |
|
Apr 2 |
comment |
Why is application crash considered insecure? @DeerHunter If you add DoS attacks to that list I reckon you have an answer there. |
|
Mar 31 |
awarded | Outspoken |
