1,811 reputation
1620
bio website amateurlayman.com
location Lower Hutt, New Zealand
age 45
visits member for 3 years
seen Apr 21 at 23:35

A software developer.


Apr
21
answered Is there a value in using portable programs on a USB key?
Apr
16
reviewed No Action Needed How are two systems able to set up a secure SSH tunnel over a public connection?
Apr
16
comment Go through proxy server to Find an original IP Address
Can you clarify your question please: Please confirm that you are trying to trace the website of the third party. Which service do you use for IP Address Finder? And are you talking about the 'physical' location of the server? i.e. Looking at the Geo IP settings of the website.
Apr
16
answered Demonstration of how security through obscurity fails to work
Apr
16
answered Why do some websites need time to log you in securely, while others can do it instantly?
Apr
15
comment Can malware cause firefox to send GET requests?
Generalised requests for resources are easy too: such as the infamous Web Bug (en.wikipedia.org/wiki/Web_bug) , a request for an image from a third party web-site.
Apr
10
comment Heartbleed - is this scenario possible? how bad would it be?
Thanks for keeping me honest @pyramids, At the very least the CA business will be likely closed unless the browser makers can be convinced that 'things have been fixed'.
Apr
10
answered Heartbleed - is this scenario possible? how bad would it be?
Apr
10
awarded  Custodian
Apr
10
reviewed No Action Needed What is HeartBleed?
Apr
10
revised Is a web application firewall necessary if the application is secure?
Adding COTS
Apr
10
answered LastPass login security
Apr
8
comment Are networks using EAP-TLS affected by Heartbleed?
This will depend on the server implementation, at a minimum to be affected the server will need to use OpenSSL. But there are many other layers/technologies in Wifi networks so that is probably not the only consideration.
Apr
3
answered How Web-proxy and Virtual-Hosting are complications for HTTPS?
Apr
2
comment Does http support encryption without https (like STARTTLS)?
@cnst the non-support of the https protocol is a browser makers choice, likewise the non-support of STARTTLS. Both require exactly the same technology but STARTTLS over http has no installed base.
Apr
1
comment Does http support encryption without https (like STARTTLS)?
@cnst, you can easily do exactly as you mention with the https protocol. These are called self signed certificates. BUT self signed certificates can be easily subverted by a man-in-the-middle attack causing the 'security' you add by encrypting the payload to be rendered useless. If you encrypt without verifying a signer of a certificate then a third party located in the network can also sign a certificate and impersonate the remote end point.
Mar
23
answered Is a web application firewall necessary if the application is secure?
Mar
23
awarded  Popular Question
Mar
21
answered Alternative to security questions for account recovery when email isn't an option
Mar
2
awarded  Nice Answer