Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
5
Newest
 Commentator
Impact
~1k people reached

Jun
30
awarded  Commentator
Jun
30
comment Unsubscribe safely
This is very interesting. But I dont't like the "block" part. Typically, I want to unsubscribe from Apple's news, but I don't want to block e-mails from Apple.
Jun
30
comment Unsubscribe safely
Nice, but this misses the goal: unsubscribing. This just like reading the e-mail and then putting it in the trash. Why would the e-mail address then be marked as inactive?
May
12
comment New Gmail login system—going against conventional wisdom?
@SteveDL — I agree with you : “from a usability viewpoint”. Sometimes, I too try different couples (user name ; password), this is annoying. But the Web sites are doing this for a good reason. As often, usability conflicts with security.
Aug
28
comment HTTP Basic auth password storage more secure than Digest auth
The RFC is incorrect in its first paragraph. In the Basic auth, the username and password are not transmitted in clear text. They are transmitted in an encoded string.
Aug
27
comment HTTP Basic auth password storage more secure than Digest auth
As I understand it, Digest does not imply storing the passwords on the server. The server can store hashes (non-reversible).
Aug
27
awarded  Editor
Aug
27
revised Why is “www.” considered unsafe in this HTTPS URL?
Undoing the wrong "correction", "behaviour" is perfectly correct, respect the original author
Aug
27
suggested approved edit on Why is “www.” considered unsafe in this HTTPS URL?
Apr
10
comment Mobile Carrier Javascript Injection
This is not clear. At first sight, I had understood "a clear option to opt-out is a clear violation". The opposite of what you certainly want to say.
Jan
27
awarded  Critic
Jan
27
comment Should websites be allowed to disable autocomplete on forms or fields?
But what if the person using your computer is you ? Which is the case most of the time.
Jan
27
comment Should websites be allowed to disable autocomplete on forms or fields?
I see that the OWASP gives really bad advice — in addition to using the wrong words.
Mar
6
answered Does disabling right click have any impact on security?
Mar
6
comment FireFox's restore previous session restores logins authenticated by server's sessions
@Celeritas — “If the "remember me" check box is not checked then the session will still be remembered in Firefox.” This is because you did not set a cookie duration, no ? You can set a cookie duration if you want the login to expire. For instance 24 h. If I were a user of your site, I would probably not like that, but I think that would achieve the goal you want.
Mar
5
comment FireFox's restore previous session restores logins authenticated by server's sessions
@Celeritas — When I check a box named Remember, I want the site to… remember. As always, security harms usability and usability harms security. So in fine the right thing to do depends on the situation and on the user's choice. Is the system the entry control of a CIA bunker or a daily life Web site ? Does the user trust his own computer in his own house ? It is good to let the user make his/her informed choice and to respect it. Hence the Remember check box, and the security explanation next to it. Thus, if the user is in a fragile situation, s/he can choose not to be remembered.
Mar
5
awarded  Supporter
Mar
4
awarded  Teacher
Mar
4
answered FireFox's restore previous session restores logins authenticated by server's sessions
Mar
4
answered Account lockout with human interaction required to unlock