402 reputation
312
bio website hileco.com
location
age
visits member for 2 years, 1 month
seen 3 hours ago

Java consultant for SOA projects. Anything i put on StackOverflow is my own opinion.

See also my Github & check out tools I use, because tools make life easier.


2d
awarded  Yearling
Sep
24
awarded  Autobiographer
Aug
27
awarded  Informed
Aug
22
accepted Why refresh CSRF token per form request?
Aug
10
awarded  Citizen Patrol
Aug
8
comment How is Truecrypt any safer than just password-protection?
@erwinmatijsen Theres some real life examples on TrueCrypt's wikipedia entry on organizations trying this guessing, though it doesn't say with what computing power the FBI's was using, it states they tried a dictionary attack ( ; guessing ) for 12 months, they then gave up.
Aug
7
revised Why do people trust PlayFramework2 dependency management?
deleted 35 characters in body
Aug
7
answered Why do people trust PlayFramework2 dependency management?
Jul
28
answered XSS in HOST header
Jun
8
comment Are legal notices in a login banner legally significant in terms of computer misuse?
Im not a lawyer but when I went to uni my networking teacher said not to put welcoming MOTDs on routers/switches, as that will be used in court, if some guy gets into it and your software tells him welcome & have fun that's what he'll do
May
15
revised Why refresh CSRF token per form request?
More information on the question of why to do it
Jan
10
comment Using skype for an attack
+1 Skype works peer to peer and in my experience I've always been able to see the hostname the ISP assigned to the person on the other end. ( For group calls you can see that of the host of the group call. )
Nov
26
awarded  Notable Question
Oct
20
awarded  Yearling
Oct
11
comment With BREACH attack, is session-based CSRF token still secure?
One of the migitations is randomizing secrets per request as opposed to a secret per session, so isnt this answer is also saying; No it is not secure to use session based csrf
Oct
2
comment What can a zombie computer feasibly install and run?
It could install and run anything with enough privileges, if you see Bitcoin as a puzzle then there already are, and have been, puzzle solving botnets.
Oct
2
comment Reflected XSS Prevention plugin
That is a page where javascript reads the input field and just appends the text as html, the xss data does not come from a request...
Oct
1
comment Reflected XSS Prevention plugin
That website sends an http header of "X-XSS-Protection:0", you can guess what that does. You cannot use that website to test a browser's XSS Protection. See also this question
Oct
1
answered Reflected XSS Prevention plugin
Sep
17
awarded  Commentator