Reputation
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
4 15 35
Newest
 Nice Answer
Impact
~122k people reached

1d
comment Do you need to restrict the possible characters of a username?
I really, really, really don't understand your whole "My email is actually a username" issue. If your system is coded properly, you will detect whether it is an email, which was confirmed through a link confirmation sent to the address, or if it's a username, which had no confirmation whatsoever. If someone tries to register with the same email later, he should be able to if the person who uses it as a username did not confirm the email. Therefore, your whole "If we accept email as username..." section is irrelevant if, once again, the system was coded properly.
Jan
28
reviewed Approve Is running wp-cli as root in docker container dangerous?
Jan
21
comment Saving encrypted username password in session
@user3018765 Yet you don't seem to understand the difference between encryption and hashing, since you said that you want to use SHA-2 for encryption, which is a hashing algorithm. Now, about your answer to my question, you did not answer it. Would the session variable be accessible by the client?
Jan
21
comment Saving encrypted username password in session
Storing it in a session implies that the client has it stored in a cookie? If so, that's a huge no.
Jan
14
revised How exploitable is the recent UseRoaming SSH problem?
Removed unnecessary statement which adds no value to the answer
Jan
13
comment Redirecting/rickrolling intruders
I don't want to burst your bubble but the chance that the owners of these scanners actually notice that you've redirected them to a Rickroll video is low. These guys are interested about the servers they've managed to infect, not what happened after an unsuccessful attempt.
Dec
8
comment Does preview link in facebook post reveal user?
They're most-likely using a proxy to relay the information like Slack does but you could quickly test it out with a server of yours.
Oct
27
reviewed Reviewed penetration testing career path
Oct
23
comment Why is U2F not good enough to be used as authentication?
The strength of U2F is to use it as a second factor. That way, if the "something you know" is compromised, the attacker still requires the "something you have". If you use the key instead of a password, the attacker only needs to acquire one factor.
Oct
23
reviewed No Action Needed Why is U2F not good enough to be used as authentication?
Oct
14
reviewed No Action Needed Should I format storage after buying it?
Oct
11
reviewed Reject Password hashing : Using 2 salts
Oct
11
reviewed Approve Mac overflow (flooding)
Oct
9
reviewed Reviewed Can my employer see that I am using Netflix on my phone using their wifi?
Oct
9
comment Can my employer see that I am using Netflix on my phone using their wifi?
Yes they can. Use your own Internet connection.
Oct
6
revised What does a switch do against a packet sniffing attack?
Removed e-mail address.
Oct
6
reviewed Approve Is there a need to image the hard drive when using a write blocker?
Oct
4
comment prevent form submission
Once the form is submitted, validate that the user who submitted has the permission to do so...
Oct
2
reviewed Reject Is it possible for corporation to intercept and decrypt SSL/TLS traffic?
Sep
30
reviewed No Action Needed Is letting users run lslogins on a shared host a security risk?