1,008 reputation
611
bio website
location
age
visits member for 3 years, 3 months
seen yesterday

1d
awarded  Nice Answer
Sep
2
comment Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
rather than relying on finding a PHP implementation of secure XSLT parser, a better security would be to setup process jail/chroot for the process running the transformer.
Aug
22
comment Downsides to using HTTPS
Cache-Control only controls browser caching in HTTPS, which isn't the issue here.
Aug
22
revised Downsides to using HTTPS
added 132 characters in body
Aug
22
revised Downsides to using HTTPS
added 89 characters in body
Aug
22
answered Downsides to using HTTPS
Aug
20
comment Is a password in the clipboard vulnerable to attacks?
Keyloggers usually would require admin privilege, but you don't usually need any special privileges to read the clipboard.
Aug
20
comment How to protect source code locally when traveling with it
Who are you worried about will steal your source code? Are you worried about a random thief? the transport security agents/hostile government? A corporate spy from competitors? Do you store production database passwords, encryption keys, or other such sensitive materials with the source code? What's your threat model?
Aug
17
comment Where can I find a list of frowned upon usernames for web sites?
Given that it's fairly easy to forge email From address, you always need to be careful when receiving emails from unknown senders, whether or not it has official titles in name that they introduced themselves as. You need to identify admins by special symbols or statuses, for example on stack exchange community moderators are given the diamond symbol. Then you only need to prohibit the diamonds symbol from being used by regular username and teach your users how to identify admins correctly rather than relying on name itself.
Aug
13
comment Can we trust antivirus software?
If this is a concern for you, an avenue is to find an open source antivirus software. Since the source code is open, you can inspect the code and assure yourself it doesn't hide any backdoors. As of now, the most popular open source antivirus software is those by clamav.
Aug
8
comment Is there ever a good reason _not_ to use TLS/SSL?
I meant between the embedded device and the server
Aug
7
comment Is there ever a good reason _not_ to use TLS/SSL?
You can setup an ssl stripping proxy between the microcontroller and the embedded device. Although you should consider the security impact, as services that offers ssl only connection usually does so out of actual concerns that they have. If you want to offer a bit of protection still, then you can rewrap the connection between the device and your proxy server with custom encryption scheme that has smaller overhead.
Aug
5
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
@Emiliano: even your site is HTTPS only, an attacker can setup a man in the middle attack and setup a fake server that uses plain HTTP, performing what is known as SSL stripping. The browser will send to the fake server the user's cookie. To mitigate this, you need Secure cookie and HSTS policy.
Aug
1
comment Should SSL be terminated at a load balancer?
If you're on a secured colocation, then it's natural that you trust your own machine (which inside a physical cage) more than you trust the data center.
Jul
31
awarded  Guru
Jul
31
comment Proof of SIM card possession on iOS devices
A SIM card is not just a dumb memory storage, it's actually a smartcard with a CPU, RAM, ROM, and tamperproof storage area, and has an embedded OS and is capable of running applications written in a subset of Java.
Jul
31
awarded  Good Answer
Jul
30
awarded  Mortarboard
Jul
30
awarded  Yearling
Jul
30
awarded  Enlightened