Reputation
Next tag badge:
164/100 score
19/20 answers
Badges
14 101 168
Impact
~1.6m people reached

Jun
5
revised Shouldn't GPG key fetching use a secure connection?
edited tags
Jun
5
comment What might be the legal and policy consequences of traffic sniffing?
If it was me, he wouldn't be disciplined, he'd be rewarded.
Jun
5
comment What might be the legal and policy consequences of traffic sniffing?
@bob, there are companies that would still try to press charges against you, even if you did this from home. They would have no legal or ethical ground to stand on, but they'd still try....
Jun
5
revised What might be the legal and policy consequences of traffic sniffing?
edited tags
Jun
5
revised Any useful tools for Android source code review?
edited tags
Jun
5
revised Secure Linux Desktop
edited tags
Jun
5
answered Resources for physical security questions
Jun
5
comment Can I reclaim ex employee gmail account?
@Jake, note that you need to talk to a lawyer with experience on this topic (e.g. there are many who focus on internet law), as this will probably be quite niche, and most lawyers would not be familiar with this.
Jun
5
revised Can I reclaim ex employee gmail account?
edited tags
Jun
5
comment Secure Development costs
Great question, I actually did some work around that a few years ago for a relatively large-ish multi-national dev shop - unfortunately, I don't have any of those nmbers anymore :(. Bottom line, as expected, it was not cheap, and only saved money in the long run because they were currently paying so much on the pentest-fix-retest-refix cycle....
Jun
5
revised Secure Development costs
edited tags
Jun
5
revised Question of importance of FIPS in security implementations
edited tags
Jun
5
comment How can I ensure that I connect to the right wireless Access Point?
Though I agree with you about the other question(s)...
Jun
5
answered Attack vectors in POSTing variables from one php script to the next?
Jun
5
comment Attack vectors in POSTing variables from one php script to the next?
it sounds like you're referring more to "A8: Failure to Restrict URL Access". The other one - "Insecure Direct Object References" - refers more to authorizing by record key (e.g. account number).
Jun
5
revised Attack vectors in POSTing variables from one php script to the next?
edited tags
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
Hi @Matt, welcome to the site, and thanks for the great question!
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
And btw as an aside, the DSS's are very technically oriented, and they work with many in the industry to ensure that it's (relatively) on target.
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
Here's a solution, though - the "secure" 3rd party processor DLL should offer a "secure" UI to accept the CHD directly. I've guided many a vendor in implementing this solution.... That way, the CHD goes directly into their own code, and never touches your bits. (Of course, verify this with your own PA QSA).
Jun
5
comment New credit card security standards regarding PA-DSS Compliance
Now, to your points - the issue is that you are processing it, by accepting the CHD from the user. It is handled by your code, so your code needs to be PA compliant. It's as simple as that... Think of the alternative, you could be simply getting the CC's, and writing them to a file, before sending it to the DLL. See why your product would also need to be compliant?