Reputation
688
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
6 16
Impact
~15k people reached

Jan
18
awarded  Citizen Patrol
Jan
11
comment Use password to calculate checksum for API requests
@Samuel strong authentication can guarantee (to the best of our public knowledge) that request came from the client. If for example you can use 2 way authentication, where client verifies the server and server verifies the client by a certificate - it is as good as you can make it. Something like that google.co.uk/…
Jan
10
answered Any benefit to proof-of-work to avoid database lookups?
Jan
10
answered Use password to calculate checksum for API requests
Dec
3
accepted Is lack of wildcard DNS entry a security vulnerability?
Nov
28
revised Is lack of wildcard DNS entry a security vulnerability?
rolled back to a previous revision
Nov
28
awarded  Cleanup
Nov
28
revised Is lack of wildcard DNS entry a security vulnerability?
fixed type
Nov
28
revised Is lack of wildcard DNS entry a security vulnerability?
rolled back to a previous revision
Nov
28
asked Is lack of wildcard DNS entry a security vulnerability?
Oct
16
awarded  Yearling
Sep
10
comment How to prevent someone guessing the token in a reset password link
The second point is about counting how many attempts were made for each user. If you don't store it in a db how would you know?
Sep
10
answered How to prevent someone guessing the token in a reset password link
Aug
28
awarded  Commentator
Aug
28
comment Is it safe to use the SHA1 checksum of a password as a key for SHA-1?
@DavidZech social engineering, bribes or insider attack.
Aug
27
comment Is it safe to use the SHA1 checksum of a password as a key for SHA-1?
@LuisSieira chocolate bar, heartbleed, malware infection
Aug
27
comment Is it safe to use the SHA1 checksum of a password as a key for SHA-1?
I can think of an attack when Billy gets a key from the server and a database dump. That's enough to render such defence useless. A better way would be to design a system where a server has no ability to decrypt data - only user.
Jul
21
awarded  Caucus
Jul
19
awarded  Critic
Mar
6
awarded  Notable Question