User rox0r - IT Security Stack Exchange

bio	website
	location	Boston, MA
	age
visits	member for	2 years, 6 months
	seen	Apr 24 at 2:11
stats	profile views	89

	3,517 reputation	bio	website		visits	member for	2 years, 6 months
724 badges		location	Boston, MA		seen	Apr 24 at 2:11

152

168

votes

4

answers

41

kviews

Do any security experts recommend bcrypt for password storage?

jul 11 at 16:30 PBKDF2 61

86

114

votes

11

answers

14

kviews

How to securely hash passwords?

appsec cryptography passwords hash

apr 29 at 14:47 Valentin Rusk 1

21

53

votes

12

answers

3

kviews

Does an established ssl connection mean a line is really secure

web-application ssl

dec 26 '11 at 1:28 bstpierre 2,957

15

50

votes

13

answers

7

kviews

Why do sites implement locking after 3 failed password attempts?

attack-prevention passwords risk-analysis denial-of-service

jun 2 '11 at 14:39 Vineet Reynolds 1,126

51

49

votes

8

answers

5

kviews

Can anyone provide references for implementing web application self password reset mechanisms properly?

appsec web-application password-management

jul 31 at 10:21 ccellar 103

69

48

votes

18

answers

3

kviews

What security resources should a white-hat developer follow these days?

appsec attacks source-code professional-education

nov 27 at 10:14 Community♦ 1

15

35

votes

4

answers

4

kviews

Recommended # of iterations when using PKBDF2-SHA256?

cryptography passwords appsec hash pbkdf2

dec 21 at 10:47 Gilles 10.1k

29

28

votes

8

answers

4

kviews

Books about Penetration Testing

penetration-test professional-education books

apr 8 at 9:10 Ashish 33

4

19

votes

1

answer

1

kviews

Has anyone achieved PCI compliance on AWS?

compliance cloud-computing pci-dss

aug 1 '11 at 20:25 Jeff Ferland♦ 21.5k

5

17

votes

6

answers

1

kviews

Port Knocking is it a good idea?

network firewalls port-knocking

dec 18 '10 at 12:03 Mark Davidson 4,495

6

16

votes

7

answers

789

views

Securing the security guy's home office: what should we do?

network physical

dec 27 '10 at 16:02 badcode 51

3

16

votes

5

answers

465

views

What should I do when classified information stayed on a unauthorized laptop?

incident-response audit hardware forensics

jan 8 at 19:54 Iszi 9,238

7

16

votes

5

answers

290

views

What questions would the Joel test for Infosec professionals consist of?

people-management

jan 14 '11 at 0:18 AviD♦ 20.4k

3

14

votes

5

answers

349

views

What are good ways to educate about IT security in a company?

corporate-policy user-education

sep 29 '11 at 13:44 Jeff Ferland♦ 21.5k

10

13

votes

2

answers

753

views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

passwords privacy federation openid oauth

feb 22 at 14:56 makerofthings7 12.6k

5

12

votes

2

answers

228

views

Establishing routines on what to do if a PC gets stolen

corporate-policy incident-response physical

jan 13 '11 at 16:30 Scott Pack 7,986

12

11

votes

1

answer

1

kviews

REST specific security weaknesses

appsec certificates rest web-service

apr 26 '11 at 15:00 AviD♦ 20.4k

1

11

votes

3

answers

328

views

Is passing sensitive data through the process environment secure?

linux unix confidentiality

sep 18 at 9:00 Gilles 10.1k

4

10

votes

6

answers

5

kviews

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?

cryptography passwords hash .net

apr 17 '12 at 18:37 D.W. 44.8k

3

10

votes

4

answers

322

views

Where are some Security Policies that are actually in use?

corporate-policy research

jun 5 '11 at 3:04 Scott Pack 7,986

4

8

votes

4

answers

427

views

Security policy for system administrators

corporate-policy privileged-account

jul 20 '11 at 16:11 Scott Weil 51

9

8

votes

2

answers

3

kviews

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

encryption windows certificates public-key-infrastructure certificate-authority

jan 5 at 14:54 makerofthings7 12.6k

1

7

votes

2

answers

787

views

Caller ID Spoof and Text Spams – How do they work?

mobile spam

jun 9 '11 at 22:00 Mark Davidson 4,495

3

6

votes

3

answers

2

kviews

Changing policy to allow USB drives. Why should I try to stop it?

corporate-policy usb-drive

jun 6 '12 at 3:53 D.W. 44.8k

2

6

votes

1

answer

263

views

Sulley - optional element and command check

buffer-overflow fuzzing ftp

aug 31 at 15:34 trs80 179

1

5

votes

2

answers

161

views

What kind of certificate do I need to be able to sign my own subdomain certificates?

ssl certificates certificate-authority

jan 13 at 19:47 Thomas Pornin 82.8k

1

4

votes

2

answers

564

views

What are the advantages of EV Certificate?

ssl certificates certificate-authority

jun 10 '12 at 13:06 Andrey Botalov 1,132

1

4

votes

1

answer

161

views

Thoughts on creating unscalable conditions to brute force even small passwords?

cryptography encryption passwords

jan 7 '12 at 18:55 Community♦ 1

1

2

votes

4

answers

276

views

Does outsourcing infrastructure services reduce risk (and improve security)?

cloud-computing risk-management outsourcing

apr 22 '12 at 7:23 Robert David Graham 2,755

rox0r

29 Favorites