Reputation
43,779
Next tag badge:
164/100 score
19/20 answers
Badges
14 101 168
Impact
~1.6m people reached

15h
comment How could Craig Wright obtain Satoshi Nakamoto's private key?
I'm voting to close this question as off-topic because the assumed premise of the question is demonstrably false: Craig Wright did nothing to demonstrate he stole the private key.
15h
comment PHP source code of a web page
Why dont you read the basic articles available (such as wikipedia and owasp) to understand the relatively simple concept?
1d
comment What is same site scripting and what are some exploit scenarios?
Umm... What you describe is exactly standard CSRF. Just like with XSS (e.g. Stored XSS), it doesn't matter if the payload is really launched from another site or not. The SSRF you expanded is also wrong - that stands for Server Side Request Forgery, not "same site".
2d
awarded  Favorite Question
May
1
comment Does FTPS (FTP+S) offer better security than SFTP on the server side?
It is worth emphasizing that there is a common mistake here, that seems like your 3rd party sysadmin is making (in fact most of the answerers also seem to have missed this point, though a couple did mention this in passing such as @Steffen): SFTP != FTP-over-SSH. In fact SFTP is a subprotocol, related to the SSH family, but it is distinct and separate from SSH, and completely unrelated to FTP. It sounds like he might be thinking of something like SecureFTP (which IS FTP-over-SSH), which has a lot of the drawbacks he mentioned. See more here: security.stackexchange.com/q/858/33
Apr
27
comment Why is Linux considered more secure than Windows?
@RobertMennell Considered by whom? Certainly not by any knowledgeable professional (assuming they are willing to put their religious feelings aside).
Apr
26
awarded  Notable Question
Apr
26
comment Free tools to run automated security audits for PHP code?
and @lepe yes there are many such tools (e.g. google for "static analysis"), but few free ones are good, and few good ones are free.
Apr
26
comment Free tools to run automated security audits for PHP code?
Even though this question is defined as off-topic, it HAS been asked here numerous times already, you could find a list of products in the various questions...
Apr
26
comment How to recommend a (more) secure router
Perhaps instead of just asking for methods of research (which is really just asking for reliable sites...), perhaps you might want to try phrasing the question more along the lines of "what criteria are important to consider?", eg which security features are important, specifics of vulnerabilities, etc. E.g. check how some of the questions in the vendor-selection tag are framed. It's not about which is "best", its about how to compare, and how to find the right trade-offs. (e.g. custom firmware might be great for somebody technical, but others would need secure defaults...)
Apr
25
comment Is keeping business data in browser database websql secure?
@Michael no, I am suggesting that since WebSQL is deprecated, it should not be used for anything at all; since it will not be updated, it should especially not be used for anything sensitive. On the other hand, IndexedDB is still supported, standardized, and updated. Technically speaking, since they are both stored and implemented in the browser, they do have similar threats, but the technical implementation may be different and have different vulnerabilities (which would likely not be fixed in WebSQL...)
Apr
18
comment Hacker's code of ethics, does it exist?
p.s. "Certified Ethical Hacker" is a specific certification (eccouncil.org/Certification/certified-ethical-hacker), not a generic term that is certified by somebody. Actually when you think about it, the term itself is incredibly meaningless.
Apr
18
awarded  Popular Question
Apr
18
revised What purpose does Access-Control-Allow-Origin have?
edited tags
Apr
15
comment Avast AV could read Firefox saved passwords
I will remind everyone here of the first rule of StackExchange: Be Nice.
Apr
10
comment Designing in zero day attack mitigations
@BrentKirkpatrick, I'm not quite sure what your point is here? (And btw, BO has not been the most common in quite a few years... And code injection != buffer overflow...)
Apr
6
comment Upgrading security of hashed passwords
One side note: bcrypt manages its own salt internally, you don't need to generate and store it.
Apr
1
comment Password sent over TLS: threats other than TLS compromise?
Is this between a web browser and webserver? If so, there are additional issues on the browser side, as covered here: security.stackexchange.com/q/988/33
Mar
29
comment How should I distribute my public key?
@hamena314 I think not :-). I think you're reading it as "no risk in exposing your private key", which is not the same as what I wrote, "no risk of exposing". I.e. there is no such danger. If you read the whole sentence, "There is no risk of exposing your private key by publishing your public key" -> publishing your public key does not put your private key at risk of exposure. Sorry for the confusing sentence structure!
Mar
16
comment Pin delivery: SMS, mail, or pin mailer?
Stanko, welcome to Information Security. Please do not include marketing spam in your answers - that might actually get you banned. (I rescued this answer because it actually has genuine content, aside from the spam.)