Reputation
41,028
Next tag badge:
159/100 score
19/20 answers
Badges
14 94 162
Newest
 Good Answer
Impact
~1.5m people reached

1d
awarded  Good Answer
Feb
3
awarded  Nice Answer
Feb
2
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@PyRulez I added a comment or two, such as they are... Though my intent wasn't a point-by-point rebuttal of other answers, but to contrast both sides of the obscurity/opensource debate...
Feb
2
revised My school wants to keep the details of our door authentication system a secret. Is that a good idea?
added 625 characters in body
Feb
2
answered My school wants to keep the details of our door authentication system a secret. Is that a good idea?
Jan
26
comment HTTP HEAD and its security versus operational uses
Very good answer here already, so I won't mark it as duplicate, however you might find this interesting too: security.stackexchange.com/q/21413/33
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@Zibbobz But that's the point - a good password should not be able to be broken by an algorithm. That is why password strength is not at all about your creation algorithm, but ONLY about entropy.
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@msouth pffftt.
Jan
22
awarded  Guru
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
-1 for saying its not bad advice, but +1 for pointing out the resulting commonalities from a limited set of likely favorites, and preferring a password manager...
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
Bottom line and in short - very bad advice.
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
Also, this is pretty much a duplicate of several questions here. I will find one that is closest, then it will probably get closed as duplicated :-(
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
First of all you didn't follow their advice - they specifically said a musical artist, of which Bieber is neither.
Jan
19
revised How to make / dump contents of memory for forensics analysis?
added 168 characters in body
Jan
19
comment Is keeping business data in browser database websql secure?
A full answer would need to be longer, but you should note that WebSQL is obsolete and deprecated for over 5 years now, and you should not ever be using it for anything at all. Definitely not sensitive data. That said, there are other alternatives, such as IndexedDB and LocalStorage - for these, you would need a fuller answer.
Jan
19
awarded  Good Answer
Jan
18
comment How to Securely Implement a “Remember Me” Feature?
My answer is incomplete and has a nontrivial flaw, in some situations - please see @Scott's answer, security.stackexchange.com/a/109439/33 .
Jan
18
comment How to Securely Implement a “Remember Me” Feature?
Thanks @scott - it took me a while to grok the importance of the timing attack here, but now I see you are correct! Also agree on the other points for the most part, but I'm not sure that's the way I intended it anyway :-). But yeah, the timing attack does make a load of sense, and all the difference!
Jan
17
revised Proving an action was done at an exact time - a posteriori
edited tags
Jan
17
revised What is the etymology of “Salt” in relation to password storage?
edited tags