743 reputation
17
bio website
location
age
visits member for 1 year, 10 months
seen 2 days ago

Aug
26
answered possible implications of disabling Windows Server “administrator” account?
Aug
22
revised How trustable is third party root certificates?
added 27 characters in body
Aug
22
revised How trustable is third party root certificates?
added 85 characters in body
Aug
22
answered How trustable is third party root certificates?
Aug
19
comment Basic Website Protection (XSS,SQL-inject,hashing)
Excellent. I think I read too much between the lines and assumed you were using javascript to validate input.
Aug
19
comment Basic Website Protection (XSS,SQL-inject,hashing)
"Also, is having logic on the client a risk?" Huge risk. Never rely on client side filtering (or trust client side input). It's trivial for a malicious user to bypass.
Aug
17
comment Same-origin policy for desktop application?
For starters the website could be susceptible to CSRF or XSS. While this may not cause a permanent compromise, you could still have a very bad day depending upon the payload. For seconders, your statement in the question above doesn't specify "unless there is a vulnerability in the browser or extension/plugins" - Which is my whole point. It's very misleading. Someone may read that and think they are safe, when they are in fact, not. The entire statement I quoted in my first comment is inaccurate and misleading and needs to be revised.
Aug
16
comment Same-origin policy for desktop application?
No, no you are NOT safe, in general or otherwise when visiting a malicious website! Sandboxing is irrelevant.
Aug
15
comment internal proxy server vs DMZ proxy server
Are you referring to a reverse proxy server?
Aug
15
comment Same-origin policy for desktop application?
This statement is not accurate: "Currently, if you visit a malicious website, for example a website impersonating google, you are not compromised forever. When you leave the malicious website, you are fine again. If you didn't do anything dangerous on it, such as typing your google login information, then nothing bad happened to you." One can be persistently compromised by merely VISITING a malicious site once, without even having clicked anything.
Aug
12
comment Several processes are listening to the same interface: any problem?
In other words.... imgflip.com/i/b30pu
Aug
8
answered What kind of attacks can happen on port 80
Aug
5
answered Does an insecure computer on my home wireless network threaten other machines?
Jul
28
answered Does serving Tomcat via Apache Webserver improve security?
Jul
28
answered Only allow access to specific service running on computer in Demilitarized Zone over internet
Jul
28
revised How does Network Address Translation (NAT) increase firewall effectiveness
grammar
Jul
27
answered Firewall rules by URL
Jul
21
answered How does Network Address Translation (NAT) increase firewall effectiveness
Jul
11
comment What should you do when you notice weird traffic?
"My personal server gets portscanned, dirbustered, etc., multiple times a day. I don't even blink at those reports, it's just noise at this point." +1 To this statement. This sort of thing happens on a continual basis. You will put yourself into an early grave if you try to proactively investigate and block every person who scans your network.
Jul
9
answered Can webpages using the Google plus button get my name?