713 reputation
17
bio website
location
age
visits member for 1 year, 9 months
seen 16 hours ago

Feb
5
comment SSL Handshake failed
My vote is for bullet point number one. Check to make sure the proper intermediate/root certificates exist on the clients that are failing to connect.
Jan
15
answered Contents retrieved from a not protected url from content owner's server. Legal?
Jan
2
answered Are USB thumb drives inherently more dangerous than other removable media? Why?
Dec
18
comment Does HTTPS encryption work when there is invalid or there is no certificate?
@Adnan You're taking the context or "spirit" of the OP's question out of context for the sake of being "right". The OP's question was clearly in regards to certificates. The method you are describing is not practical for a publicly facing webserver in which anonymous/random users would need access. To my knowledge, IIS does not support RFC4279.
Dec
4
revised Organizing scheduled vulnerability scans
spelling error
Dec
4
suggested suggested edit on Organizing scheduled vulnerability scans
Nov
26
comment How to secure and limit access to a web based application hosted on a local server
Is the web server running IIS? Are you on a domain?
Nov
1
awarded  Yearling
Oct
28
revised Is SSL required for sites hosted behind WAF?
added 10 characters in body
Oct
28
answered Is SSL required for sites hosted behind WAF?
Oct
25
comment Safe to expose Active Directory via LDAPS externally?
One thing to consider, how are you going to stop nefarious users from brute forcing LDAP passwords? How are you going to prevent accounts from being locked out remotely if a malicious user stumbles across this exposed LDAP service?
Aug
27
awarded  Nice Answer
Jul
26
answered How can I find the source of traffic allegedly originating from my IP address?
Jul
16
answered Is it necessary to test all input parameters of a web application when testing its security?
Jul
11
comment SSL with GET and POST
Just wanted to point out that if you're using GETs to pass credentials (regardless if you're using SSL) that the passwords will be stored in plain text in the Web server logs.
Jun
27
answered Firewall & TCP Traffic
Jun
17
answered Are there any customizable vulnerability notification services?
May
14
comment Somehow unexpectedly my computer got infected with malware
@roxyfm - I recommend Qualys Browser Check to make sure your plugins/extensions aren't leaving you vulnerable. I would also run Secunia PSI and make sure all your programs are up to date. If you really want to take it to the next level, download the community versions of RetinaCS by BeyondTrust or Nexpose by Rapid7.
May
13
revised Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
grammar
Apr
26
comment Is it safe to allow users multiple login at different browsers & computers?
Keep in mind that gmail also tracks these logins and the user can view this history at any time, which includes Access Type, Location (IP address) and Date/Time stamps. The user also has the ability to sign out all other sessions. The user has the option to be alerted when unusual login activity is occurring. Does your application provide this functionality? Because if not, than they can't use gmail as an example to justify multiple multiple logins.