3,154 reputation
1619
bio website blog.bstpierre.org
location United States
age 38
visits member for 2 years, 10 months
seen Dec 19 '13 at 15:15

Hey


Jan
19
comment Bypassing XSS filters
See also: security.stackexchange.com/questions/164/new-xss-cheatsheet
Jan
16
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
+1 for comparing PHP to rats as an indirect plague vector!
Jan
16
revised encode der with openssl
fix formatting, grammar
Jan
10
comment Is a password protected PDF file safe for bank statement attachments?
@lszi: In the US you might start with the OTS (Office of Thrift Supervision), but I doubt you'd get anywhere. Easier to switch banks (which is not easy -- I don't say this lightly).
Jan
9
answered How do I choose whether to trust a particular website?
Jan
6
comment How many authentication factors are there?
"Somewhere you are" could also require being physically present in front of a given system.
Jan
6
comment Encrypt files on flash drive for easy decryption
+1 -- the OP is asking the wrong question. The real question is "How can I give files to my non-computer-savvy accountant?" The flash drive is a distraction.
Jan
5
comment With which algorithm I can prevent a brute force on a login?
@e-sushi: I agree with what Rory said, +1 if you update your answer. Also, when I said DoS the admin, I interpreted what the OP said about having the admin locked out of his account because someone tried to login using that account. OP also specified no captcha.
Jan
4
comment With which algorithm I can prevent a brute force on a login?
Sure, that would work (see my answer), you should mention that second layer in your answer. A naïve implementation of lockout as described in your answer could be used to DoS the admin.
Jan
4
answered With which algorithm I can prevent a brute force on a login?
Jan
4
comment With which algorithm I can prevent a brute force on a login?
The problem with this approach is that I can block your access to the system if I know your username. I don't even have to want to access your account, all I have to do is enter "password" three times and now you're blocked until tomorrow, at which point I can block you again (...or my crond can block you again).
Jan
4
comment Difference between vulnerabilities on windows/linux/mac for same program
+1, see also 64-bit-specific vulns, e.g. guninski.com/where_do_you_want_billg_to_go_today_4.html
Jan
2
comment Secure one-time-use credit cards
You'd probably get answers more focused on the money/consumer side on money.SE.
Jan
1
comment How to implement secure device identification in a for-pay wifi router to prevent usage fraud?
+1 for strong crypto. Anything else is just a hack.
Dec
30
revised Security while connecting to a mysql databse using pdo
formatting
Dec
28
comment Setting up a honeypot
@ryyst: Some ISPs may filter traffic so that ports 137-139 (and others) can't even reach you. I'd suggest running a "noisy" port scan on the ports you want to reach from a host on another network. Watch your logs when you run the scan -- if you don't see your scan, then the packets are probably getting filtered by your ISP. (Don't run a "stealth" scan -- these packets won't show up in your logs by design.)
Dec
27
answered How would you analyze an image to find out if there are scripts embedded in it?
Dec
27
revised Is Teredo in my router a back door?
spelling; embed image
Dec
26
answered How to exploit this SQL inection vulnerability?
Dec
26
revised static IV and random keys using aes-256-cbc
edited tags