Reputation
Next tag badge:
159/100 score
19/20 answers
Badges
14 94 163
Newest
 Nice Answer
Impact
~1.5m people reached

19h
comment Are SSL browser sessions kept alive across requests?
@NeilSmithline that's... that is... huh. That is very odd. In Wikipedia's OSI entry, it specifically does note that it is a conceptual model only... Weird. Perhaps we should update that Wikipedia article...
1d
comment Threat modeling
Why do you say that there is more risk with the installation of an antivirus? Because an antivirus is software. Software can have bugs. Bugs can enable threats. If an antivirus is deemed to be a reliable security mechanism, what is? Well, not getting in to whether or not its good (I don't like it for most issues, but it has value). Point is even a GOOD security mechanism is still software. How would you model security mechanisms? Same as any other software. Of course, in addition to whether or not it actually mitigates the intended threat, but also if it introduces any new ones.
1d
comment Are SSL browser sessions kept alive across requests?
Aww that was a great answer up until the very last paragraph.... You're wrong there, SSL/TLS is NOT in layer 6 of the OSI model. Do you know why? BECAUSE SSL/TLS IS NOT AT ALL IN THE OSI MODEL. Oops, sorry for shouting, but the OSI model is not used, it is not even real, it is merely a "conceptual model". TCP/IP is a complete separate, if vaguely similar, model to OSI. </nitpicking> I just wish people would stop saying OSI when they mean "layers of the TCP/IP stack"... ;-)
1d
comment Threat modeling
@Motivated Antivirus is typically considered a security mechanism, however as we've seen lately - if you install a popular antivirus on your machine, you've added more risk than you mitigated. By simply installing the AV, you've put your entire OS in danger. Generally speaking, any functionality - security features included - could potentially introduce new threats. That is why it is important to threat model your security mechanisms too.
2d
comment Can I read the domain name from HTTPS before SSL handshake?
Comments are not for extended discussion; this conversation has been moved to chat.
Feb
9
comment Hoomomorphic encryption for e voting
I'm voting to close this question as off-topic because we are not a source code outsourcing service.
Feb
9
awarded  Nice Answer
Feb
8
revised Open Root File Using Other Users “.bashrc -> .profile”
rolled back to a previous revision
Feb
8
revised Criteria for Evaluating Static Analysis Tools
Added continuous integration/deployment, highlighted bullets for readability
Feb
6
awarded  Good Answer
Feb
3
awarded  Nice Answer
Feb
2
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@PyRulez I added a comment or two, such as they are... Though my intent wasn't a point-by-point rebuttal of other answers, but to contrast both sides of the obscurity/opensource debate...
Feb
2
revised My school wants to keep the details of our door authentication system a secret. Is that a good idea?
added 625 characters in body
Feb
2
answered My school wants to keep the details of our door authentication system a secret. Is that a good idea?
Jan
26
comment HTTP HEAD and its security versus operational uses
Very good answer here already, so I won't mark it as duplicate, however you might find this interesting too: security.stackexchange.com/q/21413/33
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@Zibbobz But that's the point - a good password should not be able to be broken by an algorithm. That is why password strength is not at all about your creation algorithm, but ONLY about entropy.
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@msouth pffftt.
Jan
22
awarded  Guru
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
-1 for saying its not bad advice, but +1 for pointing out the resulting commonalities from a limited set of likely favorites, and preferring a password manager...
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
Bottom line and in short - very bad advice.