Reputation
2,286
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
4 16 35
Newest
 Yearling
Impact
~130k people reached

Apr
1
awarded  Yearling
Mar
11
comment Is DNS caching a security vulnerability?
I don't see why all of a sudden, an IP that was reserved for X service would be reassigned to Y service.
Mar
8
reviewed Approve Client-side BCrypt, store salt and hash separately in MySQL database
Feb
23
comment Is it possible to modify your user agent http header for malicious use?
By "data", Neil obviously meant information such as user agent, OS, etc, not fields sent by the client such as username/password (even those need to be validated but that's a different matter). He is absolutely right that you cannot trust this information (again, user agent, OS) to authenticate a user, since all of these can be spoofed.
Feb
23
reviewed Reject Can a WiFi access point operator tell that I'm streaming video to my phone?
Feb
23
reviewed Reject How does WiFi password cracking work?
Jan
28
reviewed Approve Is running wp-cli as root in docker container dangerous?
Jan
21
comment Saving encrypted username password in session
@user3018765 Yet you don't seem to understand the difference between encryption and hashing, since you said that you want to use SHA-2 for encryption, which is a hashing algorithm. Now, about your answer to my question, you did not answer it. Would the session variable be accessible by the client?
Jan
21
comment Saving encrypted username password in session
Storing it in a session implies that the client has it stored in a cookie? If so, that's a huge no.
Jan
14
revised How exploitable is the recent UseRoaming SSH problem?
Removed unnecessary statement which adds no value to the answer
Jan
13
comment Redirecting/rickrolling intruders
I don't want to burst your bubble but the chance that the owners of these scanners actually notice that you've redirected them to a Rickroll video is low. These guys are interested about the servers they've managed to infect, not what happened after an unsuccessful attempt.
Dec
8
comment Does preview link in facebook post reveal user?
They're most-likely using a proxy to relay the information like Slack does but you could quickly test it out with a server of yours.
Oct
27
reviewed Reviewed penetration testing career path
Oct
23
comment Why is U2F not good enough to be used as authentication?
The strength of U2F is to use it as a second factor. That way, if the "something you know" is compromised, the attacker still requires the "something you have". If you use the key instead of a password, the attacker only needs to acquire one factor.
Oct
23
reviewed No Action Needed Why is U2F not good enough to be used as authentication?
Oct
14
reviewed No Action Needed Should I format storage after buying it?
Oct
11
reviewed Reject Password hashing : Using 2 salts
Oct
11
reviewed Approve Mac overflow (flooding)
Oct
9
reviewed Reviewed Can a WiFi access point operator tell that I'm streaming video to my phone?
Oct
9
comment Can a WiFi access point operator tell that I'm streaming video to my phone?
Yes they can. Use your own Internet connection.