Reputation
1,087
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
9 11
Newest
 Yearling
Impact
~62k people reached

Nov
19
awarded  Yearling
Aug
30
comment Is always using HTTPS a good idea?
Re: SSL not needed for a "purely static brochureware site" — because of stuff like this arstechnica.com/business/2015/08/…, even a static site will benefit from SSL. It make sure your customers see what you want to show them, not ads or malware injected by a compromised router, a bad network, etc etc etc.
Jul
24
awarded  Constituent
Jul
22
awarded  Caucus
Jul
16
comment Is this idea for a password manager secure? If so, why doesn't anybody use it?
Agreed, but an additional detail — some password managers like this allow you to set (and force you to remember) a counter of some sort, so you can generate a new password for an existing service by incrementing a number.
Jun
23
answered Work using net nanny
Jun
23
comment Work using net nanny
@JennyD — when "at work" (in this context), it's extremely likely anything on that computer could be monitored, SSL or not.
Feb
2
comment Risk of keeping OAuth2 client_secret in application
On the desktop, your application can also register to handle specific url schemes. As an alternative, you can use an in-app browser, so you don't have to open (for example) Google Chrome for the user to log in.
Feb
2
comment Risk of keeping OAuth2 client_secret in application
Depending on the API you're using, you can probably use a non-http url (for example, myapp://oauth-response), and capture that in your application
Feb
2
answered Risk of keeping OAuth2 client_secret in application
Jan
14
comment Double step verification system for homepage
Google Authenticator uses that very same Time-based OTP algorithm. So if you implement that, you can have your users log in using the same app (or another one that uses the same standard — most do)
Jan
14
answered Double step verification system for homepage
Jan
14
awarded  Good Answer
Dec
29
comment Email account password change via email-to-script
Exactly — regardless of any technical details, the worst part is telling your users to "email their password" — this should never ever be done, no matter the specifics of this scenario.
Dec
29
comment Email account password change via email-to-script
Sidenote: even if your script deletes the sent email, it might still persist in the user's email app. Additionally, it's a Bad Idea to teach your users it's ok to email passwords anywhere.
Dec
23
comment Which PHP encryption method is most incidentally-secure?
A "hash" and "encryption" are not the same thing, you need to make your question much more specific if you want helpful answers. That is — what exactly do you want to accomplish with "encryption"?
Dec
1
comment Does password-hashing “busy-work” need to be cryptographically secure
Yes, but there's also this general logic: "the simpler the system, the more secure it is". Because not having code means that you can't have bugs in that code (if it doesn't exist). If you re-wrap "secure stuff" in "insecure stuff", it doesn't generally reduce the security of the secure part, but it's even better to not have the insecure stuff in the first place.
Dec
1
answered Does password-hashing “busy-work” need to be cryptographically secure
Nov
30
awarded  Necromancer
Nov
19
awarded  Yearling