Reputation
26,414
Next tag badge:
100/100 score
17/20 answers
Badges
5 56 120
Impact
~1.9m people reached

Jan
1
comment Avoid unauthorized updating of online leaderboard php/sql
@TTT - First, about server time vs client time, reread what I wrote -- we are in agreement. I never said anything about trusting a client submitted time. I said you only trust the time that it was submitted as given by the server's clock and then validated server-side to work to produce a given score. I never said anything about looking at a client's time or the client submitting a time. E.g., a puzzle was released at noon and your leaderboard consists of the first people who submitted valid solutions with the times received by the server.
Dec
31
answered Avoid unauthorized updating of online leaderboard php/sql
Dec
31
answered Are zip codes considered to be personal identifying information?
Dec
28
awarded  Good Answer
Dec
26
awarded  Taxonomist
Dec
22
comment is g-zipping assets a security concern?
If the compression is done actively and includes compression of secrets (e.g., session cookies) there can be active attacks to steal those secrets, for example CRIME (where you guess parts of the secret and look for reduction in the compressed content when the guess is correct). That said in serving static resources (with no secret tokens included), there isn't a legitimate reason to not compress the static resource.
Dec
22
comment Why does openssl enc -aes-256-cbc -a -salt increase the file size?
@dave_thompson_085 Nitpick to your nitpick, read the question - I didn't bring up the -salt flag from no where, the question asker used it in his command (sure I could have said it's the default, but the flag was explicitly specified). I agree about the entropy part (though in reality 70 bits is probably fine too); the electricity cost to break a 70 bit passphrase is about $10 million plus ~50,000 GPU years. When you can use a $5 wrench or covertly install a keylogger or the info isn't worth millions, then its safe.
Dec
10
awarded  Nice Answer
Nov
21
awarded  Notable Question
Nov
15
answered Using a password hash…as the password?
Nov
12
awarded  Nice Answer
Nov
10
awarded  Nice Answer
Nov
5
comment Spoof another IP address in the same network,will the spoofing source get the response?
Assuming a star network topology (which is the norm for ethernet these days).
Nov
1
awarded  Nice Answer
Oct
28
revised Can I use port 443 without SSL?
added 472 characters in body
Oct
28
answered Can I use port 443 without SSL?
Oct
13
revised Avoiding HIPAA, will this work?
added 479 characters in body
Oct
13
revised Avoiding HIPAA, will this work?
added 479 characters in body
Oct
13
revised Avoiding HIPAA, will this work?
added 479 characters in body
Oct
13
answered Avoiding HIPAA, will this work?