Reputation
41,148
Next tag badge:
159/100 score
19/20 answers
Badges
14 94 163
Newest
 Nice Answer
Impact
~1.5m people reached

9h
comment Are credentials sent via plain text to HTTP proxy?
He doesn't need to, he already has what you sent.
13h
comment Are credentials sent via plain text to HTTP proxy?
See also: security.stackexchange.com/q/23561/33 . Not exactly a duplicate, since that one asks the same question but over SSL/TLS, but it is very closely connected. That said, I think the answer here is fairly obvious to you, since you've asked the question...
13h
comment Are credentials sent via plain text to HTTP proxy?
Even if you use hashes (I am assuming you actually mean Digest authentication?), it does not protect you against active man in the middle attacks.
13h
comment Are credentials sent via plain text to HTTP proxy?
It is also not resilient against active man in the middle attacks...
2d
comment Are SSL browser sessions kept alive across requests?
@NeilSmithline that's... that is... huh. That is very odd. In Wikipedia's OSI entry, it specifically does note that it is a conceptual model only... Weird. Perhaps we should update that Wikipedia article...
Feb
11
comment Threat modeling
Why do you say that there is more risk with the installation of an antivirus? Because an antivirus is software. Software can have bugs. Bugs can enable threats. If an antivirus is deemed to be a reliable security mechanism, what is? Well, not getting in to whether or not its good (I don't like it for most issues, but it has value). Point is even a GOOD security mechanism is still software. How would you model security mechanisms? Same as any other software. Of course, in addition to whether or not it actually mitigates the intended threat, but also if it introduces any new ones.
Feb
11
comment Are SSL browser sessions kept alive across requests?
Aww that was a great answer up until the very last paragraph.... You're wrong there, SSL/TLS is NOT in layer 6 of the OSI model. Do you know why? BECAUSE SSL/TLS IS NOT AT ALL IN THE OSI MODEL. Oops, sorry for shouting, but the OSI model is not used, it is not even real, it is merely a "conceptual model". TCP/IP is a complete separate, if vaguely similar, model to OSI. </nitpicking> I just wish people would stop saying OSI when they mean "layers of the TCP/IP stack"... ;-)
Feb
11
comment Threat modeling
@Motivated Antivirus is typically considered a security mechanism, however as we've seen lately - if you install a popular antivirus on your machine, you've added more risk than you mitigated. By simply installing the AV, you've put your entire OS in danger. Generally speaking, any functionality - security features included - could potentially introduce new threats. That is why it is important to threat model your security mechanisms too.
Feb
11
comment Can I read the domain name from HTTPS before SSL handshake?
Comments are not for extended discussion; this conversation has been moved to chat.
Feb
9
comment Hoomomorphic encryption for e voting
I'm voting to close this question as off-topic because we are not a source code outsourcing service.
Feb
9
awarded  Nice Answer
Feb
8
revised Open Root File Using Other Users “.bashrc -> .profile”
rolled back to a previous revision
Feb
8
revised Criteria for Evaluating Static Analysis Tools
Added continuous integration/deployment, highlighted bullets for readability
Feb
6
awarded  Good Answer
Feb
3
awarded  Nice Answer
Feb
2
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@PyRulez I added a comment or two, such as they are... Though my intent wasn't a point-by-point rebuttal of other answers, but to contrast both sides of the obscurity/opensource debate...
Feb
2
revised My school wants to keep the details of our door authentication system a secret. Is that a good idea?
added 625 characters in body
Feb
2
answered My school wants to keep the details of our door authentication system a secret. Is that a good idea?
Jan
26
comment HTTP HEAD and its security versus operational uses
Very good answer here already, so I won't mark it as duplicate, however you might find this interesting too: security.stackexchange.com/q/21413/33
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@Zibbobz But that's the point - a good password should not be able to be broken by an algorithm. That is why password strength is not at all about your creation algorithm, but ONLY about entropy.