Reputation
1,281
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
3 16 31
Newest
 Announcer
Impact
~97k people reached

20h
awarded  Announcer
2d
comment What are the main differences between the network-level and the application-level regarding information security?
I think the question is more focused on job scope of said "job titles", as opposed to the actual work the terms describe.
Feb
7
awarded  Notable Question
Jan
30
comment Where can I find good dictionaries for dictionary attacks?
CrackStation is good.
Jan
29
comment staying not signed in: is it the safest procedure?
Yes I've read that too. But it doesn't correspond with what he wrote before that. Reading the whole essay as one piece, my conclusion is as above. (And he's clearly not a native speaker of English.)
Jan
29
comment staying not signed in: is it the safest procedure?
It's not about staying logged in. He would still logout after each session use. I'd think he is talking about saving the password in browser vs manually typing it each time.
Jan
28
comment Self-teach pentesting/CEH skills ethically
@sillyMunky, Seriously? People don't ever look at certs when hiring software devs, but for security I was under the impression "the more the merrier".
Jan
28
comment JAVA (Web Application) Public Data Assigned to Private Array-Typed Field
"A developer presumably marks a variable as private because he wants that variable to be private" is circular... "Wellington is in New Zealand. Therefore, Wellington is in New Zealand." 99.9% of times such "private" access is for code beauty, not security.
Jan
28
comment JAVA (Web Application) Public Data Assigned to Private Array-Typed Field
This pattern is not wrong in and of itself. There is actually a valid use case in situations where the performance overhead of copying a huge array cannot be justified.
Jan
28
comment How can I prevent someone from carrying out a file from a machine
@Sprottenwels, Why not do it kiosk style? I see libraries doing this.
Jan
28
comment Building a web application security focused team
@Kevin, Why not look for software developers that has a "security focus" (e.g. 3 yr exp with pentesting and etc)?
Jan
28
awarded  Electorate
Jan
27
comment How to view e-mails without internet connections?
@Loukios, See schneier.com/blog/archives/2013/10/air_gaps.html
Jan
27
comment Are there any known MD5 hash collisions of messages of different length?
@mgr326639, Might have better answers if you ask on crypto.stackexchange.com/questions/tagged/md5
Jan
26
comment Why is HTTPS not the default protocol?
@Thomas, The conclusion "HTTPS is not the default simply because HTTP was there first" isn't convincing at all. So many things has changed since then and defaulting to HTTPS has no compat problem. I contend the reason is speed and speed alone. Either that, or state-monitoring. If we presume (as your conclusion claims) that speed and latency weren't the reason, then surely Chrome could fetch the HTTPS page first and fall back on HTTP when connection times-out? (SNI is a non-issue too, as Chrome has it.)
Jan
26
comment Why is HTTPS not the default protocol?
What about accuracy? You go to Youtube for vids but it gives you contents from Facebook instead. You go to Facebook and it shows you Google instead. You go to Google and it shows you something that is not-safe-for-life. Or stuff that could put you in jail. Like... a virus download or zero-day exploit which uses your computer to share pirated stuff, or broadcast anti-state speeches (a grave or capital offense in more than several countries), or export crypto, or release state secrets, or anything for that matter. Everyone needs HTTPS, they just don't know that yet.
Jan
26
comment Why is HTTPS not the default protocol?
@JesperMortensen, Ok I realized this third comment is a few months late, but this is important: HTTPS is not about security alone. It's about accuracy too. You stated that web doesn't need security, but does the web need accuracy? (Just imagine how much mayhem there would be when we visit a.com but get contents from b.com and vice-versa. You go to youtube.com expecting to see some videos but it redirects you to bing.com.)
Jan
26
comment Detect malicious content on enourmous multi-site CMS
@schroeder, @ Mark, Google Safe Browsing can flag content as "malicious". He wants a solution akin to that instead of relying on Google (Google Safe Browsing has a delay).
Jan
26
comment AngularJS Static Analysis Tools
This is a good question and this kind of questions are perfect on quora.com .
Jan
26
comment Why do ID attributes need stricter validation?
Hmm, background and JS? I don't get why you referenced <body background="javascript:alert('XSS')"> here, it doesn't even work in any of the 9 major browsers (I tested with IE, Chrome, FF, Opera, Safari, Seamonkey, Avant, Baidu, Torch).