Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
1 1 12
Newest
 Critic
Impact
~16k people reached

Aug
20
comment Should I be worried if somebody uses my email to sign up for accounts?
Less not forget, this could simply be an innocent mistake. With the sheer number of internet users and the restricted namespace for email addresses, particularly the common webmail services - typos and simple mistakes are bound to happen.
Jun
22
awarded  Critic
May
12
comment New Gmail login system—going against conventional wisdom?
Just noticed that Adobe appear to do this as well. When entering your Adobe ID when signing in to Adobe Acrobat DC. The username/email address appears to be validated (gets a green tick) before entering the password.
Apr
13
comment Silently Limiting Login Attempts
"real users will generally take longer than" "a fraction of a second" - Yes, any real user will always take longer than a fraction of a second. Where could the "problem" be?
Mar
30
comment Does browser 'view-source' mode avoid scripting attacks?
The browser will still redirect you if the response contains a Location: header, although you do still remain in "view-source" mode (tested Chrome).
Mar
21
comment A person knows my IP address: how to save my data and address?
What's "other stuff"? Was this guy just another user of the site? Or is he an admin/site owner?
Dec
28
awarded  Famous Question
Dec
9
comment Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?
Whilst most answers mention the benefit of overwriting the data (if possible), I can't see the benefit of overwriting "a few times in a loop" as suggested in the question, but not touched on by the current batch of answers AFAICS. Unless this data is being written to a magnetic medium and the attacker has low level access to the system then I would have thought that overwriting once should be sufficient? Or is multiple writes still beneficial?
Jul
11
revised Should I let a user know they have entered an unknown username or email address?
Changed title, the question isn't actually about passwords.
Jul
11
suggested approved edit on Should I let a user know they have entered an unknown username or email address?
Jun
24
revised Won't all hashes collide after enough iterations (with a static salt)?
Spelling in title, presumably should be "static salt", not "static hash" in opening paragraph.
Jun
24
suggested approved edit on Won't all hashes collide after enough iterations (with a static salt)?
May
13
comment Is there a way to check the filetype of a file uploaded using PHP?
There is a "good" answer to this already somewhere on the Stack Exchange network (was it this site?). But basically there is no full proof way. You need to secure your system, rename the file, stream it, etc. so that when "opened" it won't compromise your system.
May
1
comment How to access directories disallowed in robots.txt?
"but they are not accessible in browser" - If they are not accessible then either they don't exist, or there is something else that is blocking them. "robots.txt" is only an advisory document for good bots.
May
1
comment How to access directories disallowed in robots.txt?
"not to index certain folders" - actually, it tells the good bots not to crawl certain files and folders. Disallowed pages can still be indexed (link only), particularly if other pages are linking to them.
Apr
11
comment The Problem with Changing All Passwords for HeartBleed
@scuzzy-delta: But why not change your password immediately if your password might have been compromised? (Even if you have to change it again after the server has been patched.) Is it because, if the server has been compromised (and the primary key is known) then changing your password will simply reveal your password to the attacker? But in this case simply logging in will reveal your password?
Mar
10
comment Does hiding version numbers increase my security?
Would an attacker (quite probably automated) run ... if (version ABC) {tryAttackXYZ()} or would they simply tryAttackXYZ()? I think the later would be more likely.
Feb
22
comment Is using SHA-512 for storing passwords tolerable?
But isn't the ability to brute force dependent on the underlying authentication system? If delays are enforced on failed authentication or the number of attempts are limited then how do you brute unless it is perhaps a distributed attack (but that could be slowed or even blocked) or the system itself has already been compromised?
Feb
8
awarded  Citizen Patrol
Jan
3
comment iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?
@danielAzuelos: James Bond used a similar technique in "Diamonds Are Forever" (1971).