1,515 reputation
813
bio website
location
age
visits member for 3 years, 6 months
seen 9 hours ago

9h
comment Why not use symmetric encryption?
Creating a public key is easy. Exchanging them securely, is not. Even though public key isn't meant to be a secret, if you send the public key over insecure channel, you will have no assurances that your adversary didn't just catch the public key in transit and replaced it with their own.
2d
comment What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?
Acid probably doesn't exist naturally in a data center environment though, so it'll be a clear indication of sabotage. Fire, OTOH, can plausibly self ignite in a date center.
2d
awarded  Guru
Dec
16
comment Does injecting querystring values directly into HTML pose a security risk?
@acbabis: you don't need links to do social engineering. Social Engineering exploits human and trust. A lot of people now know to double check suspicious emails on the website, but if you have a vulnerable website itself, then things becomes really hairy.
Dec
15
awarded  Good Answer
Dec
15
awarded  Nice Answer
Dec
15
awarded  Custodian
Dec
15
reviewed Approve Does injecting querystring values directly into HTML pose a security risk?
Dec
14
answered Does injecting querystring values directly into HTML pose a security risk?
Dec
14
answered How to call webservice securely in Android
Dec
11
answered What are these unknown visits to my private, unlisted webpage?
Dec
10
revised Computer hasn't been connected to internet for 2 weeks
added 59 characters in body
Dec
10
answered Computer hasn't been connected to internet for 2 weeks
Dec
8
comment How safe is it to use developer's version of the browsers
Are you talking about Firefox Developer Edition which is a Stable build with extra tools geared for web developers, or are you talking about Nightlies/Dev Channel which are Unstable builds for showcase and testing geared for browser developers/QA?
Dec
4
comment Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?
@Desthro: Unless you're working in real mode (i.e. you're writing an OS kernel), pointers are typically only virtual memory address; only the kernel has access to real memory addresses. It is certainly possible for the operating system to move the two memory pages to a different real address when the memory is overwritten, this can be done without changing the virtual address. This happens during swapping for example.
Dec
4
answered What are the possible exploits over a debuggable APK?
Dec
4
comment What, specifically, does the Windows Firewall do?
This analogy is fundamentally flawed. The analogy in this post actually describes a system without a firewall. When you have a firewall, the main difference is that there is a dictator landlord that has absolute authority to override the rules that Fred and George requests from the porter. The landlord may decide that the porter never deliver letters from Fred's girlfriend to Fred. That landlord is the user/sysadmin.
Dec
3
comment Do I have to hash users' IP addresses when I log them?
If you're logging banking or medical information unencrypted, you would foul many regulations, whether or not IP address is in it.
Nov
28
comment How do you explain to experts that a database server should not reside in the DMZ?
This question provides no context whatsoever to evaluate the situation properly. What is the new system about, what kind of data is in the DMZ, what are your threat model? There are many factors that needs to be considered to evaluate whether putting DB in the existing secured zone is sensible, or whether you need a new secured zone, or whether putting it outside in the DMZ is sensible. Lacking context, there are only uninformed answers below making generalized statements.
Nov
26
answered Does Tor browser work with college network?