Reputation
37,773
Next tag badge:
153/100 score
19/20 answers
Badges
14 88 160
Newest
 Nice Answer
Impact
~1.3m people reached

May
18
comment How is “something you have” typically defined for “two-factor” authentication?
SMS is not a 2nd factor, but it is out-of-band, and that has a different set of benefits. But no, it is definitely not a 2nd factor.
May
18
comment Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
@Iszi, this is not subjective, or at least shouldnt be. This is a solid discussion around password policy and enforcement, why do you think it shouldnt be here? Also, its not necessarily a Meta question, even though that is it's source...
May
17
comment What differences are there between built-in Administrator and other Administrators?
Actually, I did have a rather large well known vendor in the IT operations space that checked permissions against the "Administrators" group - i.e. checked the name of the group. Strangely none of the QA processes found this, until I reviewed the authorization code and found it... and this was only a couple years ago.
May
17
revised Verify SAML Response is from a Trusted Source
edited tags
May
17
revised How to protect from new Javascript Injection technique that doesn't use eval()?
edited tags
May
17
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
your second paragraph seems to contradict the first....?
May
17
comment Non-repudiation in Exchange/Outlook without Digital Signatures
I think he was asking retroactively... But a question, does Exchange support this signature signing? It sounds like a very interesting solution (though obviously not foolproof), didnt know Exchange has that mode.
May
17
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
Btw, "cheap security mechanisms" can also be at the application layer - mostly around training and high-level threat modeling.
May
17
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
+1 for security as marketing... unfortunately, the marketing of security is often not reflected by reality, so the benefits are possible with the real costs.
May
17
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
+1, and I'd like to keep upclicking for a while... I know I'm late to the game here, but you pretty much covered all the points I was going to answer. You even covered "security debt", along the lines of "technical debt", which was going to be my main point alongside risk management.
May
17
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
+1, I would add to this, not just security-related business, but also others need to have security as a core feature early on. E.g. financial / CC apps, PHI, etc. And yet still, this needs to be weighed against other features, from a business / product PoV.
May
16
comment Non-repudiation in Exchange/Outlook without Digital Signatures
@Iszi - added, and also added another point in 2. (though part of that might only apply to older versions of Outlook, I'm not sure if the defaults have been changed in the latest.)
May
16
revised Non-repudiation in Exchange/Outlook without Digital Signatures
Answered OP's edit "to what degree..."; deleted 1 characters in body
May
16
answered Non-repudiation in Exchange/Outlook without Digital Signatures
May
16
answered Can a HTTPS connection be compromised because of a rogue DNS server
May
16
comment Can a HTTPS connection be compromised because of a rogue DNS server
+1, very good answer. Yet another scenario, is serving the bogus HTTPS site over downgraded SSL connection. E.g. answering the client request with SSL v.2 only - if the client supports that, there are numerous additional pitfalls.
May
16
answered Can a file contain its md5sum inside it?
May
16
revised Can a HTTPS connection be compromised because of a rogue DNS server
edited tags
May
16
comment Can a file contain its md5sum inside it?
You'd be better off creating a section of the file for the md5, and a section for content. On the other hand, since anyone can recreate the hash part, what security value would you get from this? You could get tamper-protection from a digital signature (or maybe via HMAC), but a plain hash won't help you there. Or are you trying to do something else?
May
16
comment Can you get virus just by visiting a website in Chrome?
This is very subjective and unscientific - on what are you basing your claim that Chrome is the most secure browser? There are flaws foudn in it all the time... And as for sandoboxing, chrome is not the only one (though you did mention IE9, you were unbasedly dismissive of it - and, IE9 is not the only one). However, there is still some good information in here...