31,025 reputation
1398130
bio website
location Finland
age
visits member for 2 years, 5 months
seen 1 hour ago

(+)


Mar
23
comment Is Clickjacking a real security vulnerability?
@Jeroen-ITNerdbox Not really. When the user visits evil.com, he will be presented with a full version of good.com loaded entirely from evil.com. All requests, including the first request loading the page itself and then any subsequent requests, are going to evil.com from the user browser's point of view. No client-side protection can prevent this. The only way this can be protected is by informing users to check the address bar for https://good.com
Mar
23
answered Is Clickjacking a real security vulnerability?
Mar
23
comment Is Clickjacking a real security vulnerability?
@Daniel: Nathan (OP) has demonstrated a clear understanding of how Clickjacking works. Plus, nope, same-origin restrictions have nothing to do with the scenario proposed by Nathan.
Mar
20
awarded  Enlightened
Mar
20
awarded  Nice Answer
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
@MithunJohnJacob Yes! With Git you can give the developers you want access to the projects you want. Everything can be separated.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
@MithunJohnJacob You can't control code theft.. ever.. ever. If someone has access to the code, and they want to steal it, they will steal it. Hire people you trust, and make them sign NDAs. That's all you can do.
Mar
18
comment How to set up a multi-developer environment with emphasis on source code security?
Once they have Git, each developer can have their own credentials and explicit permissions to access the projects as needed.
Mar
17
revised How can I prevent that my users get a certificate issued for my domain on my behalf?
added 302 characters in body
Mar
13
awarded  Nice Answer
Mar
9
reviewed Reject BitLocker Drive Encryption NOT secure from drive mapping on network
Mar
8
reviewed Leave Closed Are there “secure” languages?
Mar
5
reviewed Delete Prevent cold boot attack on running laptop by overwriting ram
Mar
4
comment Is creating secondary account on Black-Box Pentest Forbidden?
Did you disclose the secondary accounts to the customer as soon as you finish the pentest? If not, then it's your fault.
Mar
3
reviewed Close Is using an free and anonymous VPN service safe?
Mar
3
reviewed Reject SSO software – where is symmetric key stored?
Mar
3
reviewed Reject Questions about ddosing?
Mar
3
reviewed Reject SSO software – where is symmetric key stored?
Mar
3
reviewed Approve Security concerns of downloading websites contents
Mar
3
reviewed Approve Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?