Reputation
3,919
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 11 29
Newest
 Good Answer
Impact
~291k people reached

Oct
19
suggested approved edit on Isn't openid with http an issue?
Oct
18
comment Does it matter which Certificate Authority I source my SSL Certificate from?
@TomHawtin-tackline: True enough. Perhaps I should have said, "choose a CA that is too big to fail".
Oct
17
awarded  Vox Populi
Oct
16
comment Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
@Demento: Even outside the pentesting arena, the evidence is consistent that source code review is more effective than testing. See "Code Complete" by McConnell which has good references; almost anything by Watts Humphrey at the SEI; or "Software Inspection" by Gilb and Graham. My experience bears this out too -- I can find 5-10x the bugs per hour when reviewing vs testing.
Oct
16
comment Why do botnets use IRC but not a web service for communication?
A little bit of coding on the web server backend could provide an interactive control channel to the web service.
Oct
15
answered Alternatives for DNS resolution
Oct
14
awarded  Excavator
Oct
14
revised For users that does not use PGP, what would be the other channel to securely send them a document?
fix up grammar
Oct
14
suggested approved edit on For users that does not use PGP, what would be the other channel to securely send them a document?
Oct
14
awarded  Critic
Oct
14
comment What is considered a reasonably high iteration count?
It also completely depends on what kind of target you are and how determined an attacker is going to be. Nobody's likely to bother with a 6-week attack to hack into a run-of-the-mill web app. But if the password provides access to corporate secrets or accounts worth $10M, then maybe it's worth 6 weeks worth of work... (not that you'd want to protect $10M worth of info with just a password).
Oct
13
awarded  Suffrage
Oct
13
answered Does it matter which Certificate Authority I source my SSL Certificate from?
Oct
13
awarded  Analytical
Oct
13
revised What kind of attacks against home router's NAT do exist?
reformat / blockquote
Oct
13
suggested approved edit on What kind of attacks against home router's NAT do exist?
Oct
12
answered What kind of attacks against home router's NAT do exist?
Oct
12
answered How to simulate DDoS attacks from the Internet?
Oct
11
comment How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
AviD makes a good point. I found a banking system that was obviously storing passwords as plaintext: when you go through the "reset password" routine, they mail your password back to you in plaintext via email!
Oct
8
awarded  Teacher