693 reputation
17
bio website
location
age
visits member for 1 year, 9 months
seen 7 hours ago

Oct
28
answered Is SSL required for sites hosted behind WAF?
Oct
25
comment Safe to expose Active Directory via LDAPS externally?
One thing to consider, how are you going to stop nefarious users from brute forcing LDAP passwords? How are you going to prevent accounts from being locked out remotely if a malicious user stumbles across this exposed LDAP service?
Aug
27
awarded  Nice Answer
Jul
26
answered How can I find the source of traffic allegedly originating from my IP address?
Jul
16
answered Is it necessary to test all input parameters of a web application when testing its security?
Jul
11
comment SSL with GET and POST
Just wanted to point out that if you're using GETs to pass credentials (regardless if you're using SSL) that the passwords will be stored in plain text in the Web server logs.
Jun
27
answered Firewall & TCP Traffic
Jun
17
answered Are there any customizable vulnerability notification services?
May
14
comment Somehow unexpectedly my computer got infected with malware
@roxyfm - I recommend Qualys Browser Check to make sure your plugins/extensions aren't leaving you vulnerable. I would also run Secunia PSI and make sure all your programs are up to date. If you really want to take it to the next level, download the community versions of RetinaCS by BeyondTrust or Nexpose by Rapid7.
May
13
revised Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
grammar
Apr
26
comment Is it safe to allow users multiple login at different browsers & computers?
Keep in mind that gmail also tracks these logins and the user can view this history at any time, which includes Access Type, Location (IP address) and Date/Time stamps. The user also has the ability to sign out all other sessions. The user has the option to be alerted when unusual login activity is occurring. Does your application provide this functionality? Because if not, than they can't use gmail as an example to justify multiple multiple logins.
Apr
25
answered Mitigating the loss of a mobile phone used for second-factor login
Apr
17
answered Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
Apr
15
comment For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
Odd, from my experiences if the client has the proper chain then you're good to go. Is the java client on a windows machine or unix machine? Java doesn't take advantage of the windows key/certificate store, it has its own. I'm assuming the java client is connecting via and can resolve the CN on the certificate issued to the web service, yes?
Apr
15
comment get vs post which is more secure?
In supplement to your answer, here is a nice table that outlines the differences between both: diffen.com/difference/Get_vs_Post
Apr
15
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
Best TL;DR quote ever. I think I need to create a new stack in my evernote just for your answers. Do you author any articles or books by chance?
Apr
15
comment For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?
Is updating the java certificate store of the java client with the proper intermediate/root certificate out of the question?
Apr
12
revised Why should I use the VPN?
posed as a question to make more sense. op was a question in statement format.
Apr
12
suggested suggested edit on Why should I use the VPN?
Apr
12
comment Firewall philosophy
Nope, it doesn't. Pretty neat how it works. Websense integrates with your corporate internal Certificate Authority to generate certificates on the fly for SSL enabled domains. Since your browser will trust the certs issued from your own CA and the common name matches the connection is trusted. If you view the cert path when connecting via SSL you will see it resolves to your internal CA's root. Also keep in mind that browsers are bound to a different protocol specification when communicating with proxies.