Reputation
2,115
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
3 13
Newest
 Nice Answer
Impact
~180k people reached

  • 0 posts edited
  • 1 helpful flag
  • 82 votes cast
Jan
29
answered Reverse engineering and Java
Jan
29
comment How secure is the new Mega-site encryption?
Mega themselves recognise the "lost passwd = lost data" issue and are coming up with a system to allow users to recover data using a key export feature. Check out: gizmodo.com/5978164/…
Jan
28
comment Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?
it may be legal in Europe, but your EULA that was expressly agreed does not allow it in 2.2.6. Just pointing it out to the community because it could cause some in-house lawyers to have minor heart feailure.
Jan
28
comment How to treat non-optional bad security questions?
One site I went to used the same "security questions" online as on the phone. which made for a strange conversation when I had to explain that my mothers maiden name was a mixture of numbers, non-alphanumeric characters and letters. (this is an example of bad practice btw. never use full security questions on phone and online)
Jan
28
answered Burpsuite 1.5 initiating TLS Connection on their IP to Port 443. What is it?
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
one more question: do you have any password policies in force that would normally prevent an empty password? (just trying to work out whether this is user error or indeed something quite new and interesting)
Jan
28
comment Due to which reason might a windows 7 password been reset to empty?
is this a local account or on an Active Directory?
Jan
23
comment Is there a true alternative to using CAPTCHA images?
if the arithmetic was in plain text then a reader would indeed help. However, if an arithmetical challenge would be a lot easier to interpret. It really depends what the risk appetite is and what the end goal of the CAPTCHA is.
Jan
23
answered Is there a true alternative to using CAPTCHA images?
Jan
22
answered Foolproof Jailbreak detection?
Jan
22
answered How secure is the new Mega-site encryption?
Jan
21
comment What are HTTP GET/POST flood attacks?
it's rare but I once found the other HTTP request types switched on for a custom J2EE web application. It was a mistake in the way that one of the designers had implemented HttpServlet and had accidently switched it all on.
Jan
17
awarded  Quorum
Jan
17
answered What are HTTP GET/POST flood attacks?
Jan
17
answered Should email verification links be 'time limited' after user registration?
Jan
17
answered Secure internet access while traveling
Jan
16
comment Is an ATM alert system triggered by typing the PIN in reverse a secure solution?
I used the principle "add 1 to the PIN" instead in one application, i.e. 1222, and don't issue 9999.
Jan
16
answered Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
Jan
15
answered Privacy laws' right-to-amend (and right-to-delete) requests and archived data/backups
Jan
11
comment passwords database - access control and/or synchronization
for additional choice, could also try CyberArk (again, no affiliation)