SteveS

6,935 reputation

825

bio	website	syfuhs.net
	location	British Columbia, Canada
	age
visits	member for	2 years, 6 months
	seen	12 hours ago
stats	profile views	258

Pain in the neck. Microsoft Developer Security MVP.

	6,935 reputation	bio	website	syfuhs.net	visits	member for	2 years, 6 months
825 badges		location	British Columbia, Canada		seen	12 hours ago

summary answers questions tags badges favorites bounties reputation activity

566 Actions

suggestions reviews revisions comments badges posts accepts all

1d	comment	*How can I verify the identity of a US \| UK -based person and prevent fake identities* from being accepted?** What level of assurance are you looking for? "High" is a relative term. For example, WITSEC is by design difficult to correlate new identity with old identity, so a high level of assurance here is much greater than say a high assurance by correlating identity based on name and street address.
2d	comment	Does SQL Server CE 4 decrypt data securely? I don't think SQL CE encrypts paged data, unless the paged data is already encrypted through a manual process.
2d	comment	Does SQL Server CE 4 decrypt data securely? It really depends on your threat model. Yes a full SQL server increases your attack surface, but hosting it on the same box as IIS means one less server to compromise so it negates any value, especially because we're talking about crypto-protected data. If your key and data are on the same box, protected by the same processes, you have effectively no protection gained by using crypto.
May 15	answered	Does SQL Server CE 4 decrypt data securely?
May 15	comment	What does the question mark in nmap output indicate? Why are people down-voting this?
May 11	comment	Does Disabling Right Click In Windows Explorer Do Anything? @Anonymous how does this have anything to do with copyright issues?
May 10	answered	security implications of Java's System.load vs System.loadLibrary
May 10	comment	Can I safely use an encrypted URL parameter for the session id? Sanity being relative and all, lots of sane people use predictable session IDs.
May 10	answered	Does Disabling Right Click In Windows Explorer Do Anything?
May 9	comment	Somehow unexpectedly my computer got infected with malware Not to be pedantic but you mean security measures, not measurements.
May 6	awarded	Pundit
May 2	comment	High-frequency noise deterrents You make a deterrent and the attacker will find a way to use it to their advantage.
May 2	comment	HMACSHA512 versus Rfc2898DeriveBytes for password hash And as a general rule, HMACSHA512 is not good enough for password hashes.
May 2	comment	HMACSHA512 versus Rfc2898DeriveBytes for password hash Just for the sake of clarity, is this approach reasonable for what? Password hashing yes, but for what kind of user, for what kind of site, that needs what level of assurance?
May 2	awarded	Nice Question
Apr 29	comment	Windows Phone and Hardcoding Values +1 Did not know there was such a StackExchange site.
Apr 29	accepted	What are the practical uses of large asymmetric keys?
Apr 28	asked	What are the practical uses of large asymmetric keys?
Apr 27	comment	Sending Digital Certificates Have you tried dropping the ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 \| SecurityProtocolType.Tls; line?
Apr 22	comment	“Please Enter Nth Character” without HSM shakes fist at the universe