Reputation
24,868
Top tag
Next privilege 25,000 Rep.
Access to site analytics
Badges
4 51 115
Newest
 Nice Answer
Impact
~1.7m people reached

Dec
31
answered Are zip codes considered to be personal identifying information?
Dec
28
awarded  Good Answer
Dec
26
awarded  Taxonomist
Dec
22
comment is g-zipping assets a security concern?
If the compression is done actively and includes compression of secrets (e.g., session cookies) there can be active attacks to steal those secrets, for example CRIME (where you guess parts of the secret and look for reduction in the compressed content when the guess is correct). That said in serving static resources (with no secret tokens included), there isn't a legitimate reason to not compress the static resource.
Dec
22
comment Why does openssl enc -aes-256-cbc -a -salt increase the file size?
@dave_thompson_085 Nitpick to your nitpick, read the question - I didn't bring up the -salt flag from no where, the question asker used it in his command (sure I could have said it's the default, but the flag was explicitly specified). I agree about the entropy part (though in reality 70 bits is probably fine too); the electricity cost to break a 70 bit passphrase is about $10 million plus ~50,000 GPU years. When you can use a $5 wrench or covertly install a keylogger or the info isn't worth millions, then its safe.
Dec
10
awarded  Nice Answer
Nov
21
awarded  Notable Question
Nov
15
answered Using a password hash…as the password?
Nov
12
awarded  Nice Answer
Nov
10
awarded  Nice Answer
Nov
5
comment Spoof another IP address in the same network,will the spoofing source get the response?
Assuming a star network topology (which is the norm for ethernet these days).
Nov
1
awarded  Nice Answer
Oct
28
revised Can I use port 443 without SSL?
added 472 characters in body
Oct
28
answered Can I use port 443 without SSL?
Oct
13
revised Avoiding HIPAA, will this work?
added 479 characters in body
Oct
13
revised Avoiding HIPAA, will this work?
added 479 characters in body
Oct
13
revised Avoiding HIPAA, will this work?
added 479 characters in body
Oct
13
answered Avoiding HIPAA, will this work?
Aug
26
answered HTTPS POST request header versus request body
Aug
26
comment HTTPS POST request header versus request body
This question doesn't seem to be asking about including API keys in the URL, but a HTTP request header versus in the request body (like how a POST form gets sent with parameter=value after the blank line between HTTP headers. Also if you are worried about random HTTP headers getting logged; note session cookies are sent in HTTP headers.