Reputation
26,434
Next tag badge:
100/100 score
17/20 answers
Badges
5 56 120
Impact
~1.9m people reached

Apr
20
revised how to identify plain text from cipher
added 440 characters in body
Apr
20
revised how to identify plain text from cipher
added 440 characters in body
Apr
20
revised how to identify plain text from cipher
added 440 characters in body
Apr
20
answered how to identify plain text from cipher
Apr
17
comment What are the risk implications of not verifying referer header on login form?
CSRF tokens are the only way to go. HTTP headers including Referer are trivial to spoof, and may be dropped by browsers for privacy reasons.
Apr
10
answered Is there a way to bypass Django's XSS escaping with “unicode”?
Apr
5
awarded  Nice Answer
Apr
4
revised Expanding/Inverse Hash function
added 469 characters in body
Apr
4
revised Expanding/Inverse Hash function
added 207 characters in body
Apr
4
answered Expanding/Inverse Hash function
Apr
3
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
Someone asked about uwsgi in comments.
Apr
3
comment Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
@Kave - Thanks. You need to set an environmental variable with a key of HTTPS to on. So if you call uwsgi from the command line via first example on django uwsgi page, you'd need to add the flag --env HTTPS=on. Or if you had an uwsgi.ini file you'd add the line: env = HTTPS=on. (The configuration is exactly identical to what you do for setting the environmental variable DJANGO_SETTINGS_MODULE. Just replace DJANGO_SETTINGS_MODULE with HTTPS and its value with on).
Mar
30
revised What technical reasons are there to have low maximum password lengths?
added 665 characters in body
Mar
30
revised What technical reasons are there to have low maximum password lengths?
added 665 characters in body
Mar
30
answered What technical reasons are there to have low maximum password lengths?
Mar
29
comment Security measures for a WiFi access point?
I agree with you on your main point of wifi security (use WPA2 with a strong password), but added some important clarifying points that I summarized as: Use WPA2 with a strong passphrase, disable WPS on your router (and change your SSID to not be something super common). If you want you can use MAC address filtering or disable SSID broadcast, though any patient eavesdropper can easily bypass either protection.
Mar
29
revised Security measures for a WiFi access point?
deleted 20 characters in body
Mar
29
answered Security measures for a WiFi access point?
Mar
28
comment Why on earth would anyone use the 'top secret' option of IPv4?
Just because a feature is documented in a RFC doesn't mean its used. People designing this protocol back in 1981 likely imagined using this in a world very different than our modern world. Imagine a world with no GPG, SSL, or VPNs and where networks frequently use hubs (repeating packets to all ports) versus smart switches. You can imagine that flags like this could be useful in some way to be used by hardware to route traffic responsibly based on its level. Not aware that this has ever been used; but kind of like the obscure HTTP request methods (e.g., HTTP TRACE?).
Mar
27
comment Has the WPS brute-force cracking issue been fixed?
@SmitJohnth - Never claimed you didn't understand it, but this is a forum for people who may not be familiar with WPS (Wifi Protected Setup) so some context is helpful. The reason some tool (e.g., reaver) isn't working on newer routers is likely not a new protocol that brute-forcing the entire 10^7/10^8 (e.g., CERT isn't aware of it; wifi alliance hasn't announced new WPS protocol), but instead exponential/permanent timeouts after too many bad attempts preventing WPS brute-forcing.