2,737 reputation
416
bio website
location
age
visits member for 3 years, 5 months
seen Apr 17 at 15:29

Interested in web application security and programming languages.


Mar
11
comment Closing an HTML tag without using the actual character
@bonsaiviking, Thanks. Non-visual in particular mentions some exploits like truncated UTF-8 sequences.
Jan
21
awarded  Nice Answer
Jan
3
comment What kinds of encryption are _not_ breakable via Quantum Computers?
Don't assume that just because an organization the size of the NSA is trying to build something that they expect to successfully deploy one anytime soon. Because arms-races are races, often an organization will research something because they don't want to be just starting out when their competitors are deploying one. If the NSA builds up a brain-trust of people who know about quantum computing then they might be able to deploy one ahead of their competitors, and are less likely to be caught flat-footed.
Jan
3
comment Is exploit researching different from penetration testing
Do you plan to pen-test binaries (native applications, operating system modules, device drivers, media codecs), and/or distributed applications like web applications?
Nov
29
awarded  Nice Answer
Nov
19
awarded  Yearling
Jun
20
comment Have the police placed a bug on my line
Onion routing is your friend: TOR
Jun
20
comment Is there a risk in sending the username in a password reset email?
Is any part of the reset URL a signed string of which the username is a large part? Hopefully not.
Jun
20
revised Is there a risk in sending the username in a password reset email?
Caveat was doubly negated.
Jun
20
revised Is there a risk in sending the username in a password reset email?
Fixed formatting of lists and minor grammatical issues
Jun
20
comment How to encourage responsible disclosure (and react appropriately otherwise)
The security contact listed on your website should be "security@[your-domain]" or that address should also reach you.
Jun
20
revised How to encourage responsible disclosure (and react appropriately otherwise)
added 4 characters in body
Mar
20
revised Stop code injections into page code
fixed formatting of code
Mar
20
comment Stop code injections into page code
try{document.body|=1} catch(gdsgsdg){ and dbshre=34;if(dbshre){ are silly attempts at opaque-predicates that are probably meant to prevent static analyzers from concluding it definitely does what it definitely does. This probably was run through something that obfuscates code by renaming, turning global variables into local, and adding branches governed by opaque predicates.
Mar
15
answered Is there multi-factor authentication for machines?
Feb
26
comment How can an internet contest verify unique votes with only an email as an input parameter?
@MayankSharma, the site does not have a way to tell who the real owner of an email address is, so if the cheater can intercept mail email, the real owner will never know they either voted or won, so the cheater can reroute the prize.
Feb
26
comment How can an internet contest verify unique votes with only an email as an input parameter?
@MayankSharma, why not? If you control the machine with their mail program, you can presumably intercept and reroute email from the domain associated with the contest.
Feb
26
answered How can an internet contest verify unique votes with only an email as an input parameter?
Feb
13
comment Preventing online voter fraud
The age of an account is not a barrier if the prize is significant. From Douglas Crockford's long game post: "Four years ago yesterday I approved a membership. Yesterday, that member account posted spam. They waited exactly four years to the day before spamming. <br> Many reputation systems will consider length of membership when granting capabilities to members. That works when bad actors begin acting badly immediately. But it has no effect against the long game."
Feb
13
comment Stack Smashing problem
On what platform are you running this? Are you compiling with any -march flag?