Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
1 1 12
Newest
 Critic
Impact
~21k people reached

Apr
22
comment What's the down side of a dynamic numbered radial keypad?
And if you enter the PIN based on the location of the previous button permutation does security get alerted?!
Feb
19
comment Found suspicious, obfuscated PHP file. Is this a hack attempt on my website?
Regarding the e modifier... if you are running PHP 5.5 with full error reporting then you'll be flooded with a lot of E_DEPRECATED warnings (an early warning signal that something is up!). On PHP 7 this will fail since the e modifier has been removed.
Feb
1
comment Why did customer services say using symbols in a password is insecure?
... and/or write it in a predictable manner. When forced to use a "special character" I have witnessed several people just stick a ! on the end!
Jan
29
revised How do I associate an SSID to a device?
Spelling/grammar in title
Jan
29
suggested approved edit on How do I associate an SSID to a device?
Jan
18
comment Can my computer get infected if I hover the mouse to check the thumbnail of an e-mail attachment?
The thumbnail isn't necessarily computed (from the original image). It could be embedded in the EXIF data (particularly with JPEG files) and used directly without any processing. Although whether the email client uses this is another matter and it might still require further computation (just as the original image would). For example, Windows explorer uses this embedded thumbnail when available.
Jan
11
comment Is it safe to tell credit card number to bank employee over a phone?
What is the connection with "phone banking"? FWIW (in the UK) I've not had to activate a new CC over the phone for a number of years now.
Oct
23
comment Is there any reason to block HTTPS?
Big brother is watching you!
Oct
23
revised Strange requests to my server
Grammar, removed "thanks".
Oct
23
suggested approved edit on Strange requests to my server
Sep
30
comment Is there anything insecure about Google ReCaptcha?
That comment isn't specifically targeted at Google. All I would take from that comment is that they don't want to use any third party services.
Aug
20
comment Should I be worried if somebody uses my email to sign up for accounts?
Less not forget, this could simply be an innocent mistake. With the sheer number of internet users and the restricted namespace for email addresses, particularly the common webmail services - typos and simple mistakes are bound to happen.
Jun
22
awarded  Critic
May
12
comment New Gmail login system—going against conventional wisdom?
Just noticed that Adobe appear to do this as well. When entering your Adobe ID when signing in to Adobe Acrobat DC. The username/email address appears to be validated (gets a green tick) before entering the password.
Apr
13
comment Silently Limiting Login Attempts
"real users will generally take longer than" "a fraction of a second" - Yes, any real user will always take longer than a fraction of a second. Where could the "problem" be?
Mar
30
comment Does browser 'view-source' mode avoid scripting attacks?
The browser will still redirect you if the response contains a Location: header, although you do still remain in "view-source" mode (tested Chrome).
Mar
21
comment A person knows my IP address: how to save my data and address?
What's "other stuff"? Was this guy just another user of the site? Or is he an admin/site owner?
Dec
28
awarded  Famous Question
Dec
9
comment Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?
Whilst most answers mention the benefit of overwriting the data (if possible), I can't see the benefit of overwriting "a few times in a loop" as suggested in the question, but not touched on by the current batch of answers AFAICS. Unless this data is being written to a magnetic medium and the attacker has low level access to the system then I would have thought that overwriting once should be sufficient? Or is multiple writes still beneficial?
Jul
11
revised Should I let a user know they have entered an unknown username or email address?
Changed title, the question isn't actually about passwords.