Reputation
41,118
Next tag badge:
159/100 score
19/20 answers
Badges
14 94 163
Newest
 Nice Answer
Impact
~1.5m people reached

May
27
comment Firewall Configuration Audits
Also see security.stackexchange.com/questions/1982/…
May
26
comment Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
+1, even if only for the last sentence re complex tradeoffs.
May
26
revised Is a rand from /dev/urandom secure for a login key?
edited tags
May
26
revised Why do some people really hate security via client-side?
edited tags
May
26
revised How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
edited tags
May
26
comment How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
ürgen, I think you're confused about RFI, it has nothing to do with uploading image files. Quite the opposite, its explicitly about referring to remote files, i.e. not uploaded. You seem to be referring to something more like corrupted images, or the PHP equivalent of GIFAR. Also see this question on how to validate uploaded images.
May
25
awarded  Nice Question
May
25
comment How to protect from new Javascript Injection technique that doesn't use eval()?
@Rook, agreed. My point was that these libs offer a Javascript-encoding method (JavascriptEncode() and encodeForJavascript(), respectively), that can help generically prevent the problem (IF used correctly....)
May
24
revised How do I clearly distinguish between groups of formal and informal models?
edited tags
May
24
revised What are the risks associated with relying on IPSec IP Filtering?
edited tags
May
24
answered What differences are there between built-in Administrator and other Administrators?
May
24
revised What differences are there between built-in Administrator and other Administrators?
edited tags
May
24
comment How to protect from new Javascript Injection technique that doesn't use eval()?
There are also libraries that do proper context-specific encodings, e.g. MS WPL/AntiXSS and OWASP's ESAPI.
May
23
comment How can one easily determine which IT Security related regulations apply?
See similar (but not duplicate) questions: security.stackexchange.com/q/706/33 and security.stackexchange.com/q/2083/33
May
23
comment Benefits of secure code review in-IDE vs. fatapp vs. webapp
I would also add a similar bullet for build integration...
May
23
awarded  Nice Answer
May
18
comment Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
@Iszi, naw, this isnt a question about the site, it is a question about security. The kind of thing this site was made for ;)
May
18
comment How is “something you have” typically defined for “two-factor” authentication?
SMS is not a 2nd factor, but it is out-of-band, and that has a different set of benefits. But no, it is definitely not a 2nd factor.
May
18
comment Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
@Iszi, this is not subjective, or at least shouldnt be. This is a solid discussion around password policy and enforcement, why do you think it shouldnt be here? Also, its not necessarily a Meta question, even though that is it's source...
May
17
comment What differences are there between built-in Administrator and other Administrators?
Actually, I did have a rather large well known vendor in the IT operations space that checked permissions against the "Administrators" group - i.e. checked the name of the group. Strangely none of the QA processes found this, until I reviewed the authorization code and found it... and this was only a couple years ago.