Reputation
40,968
Next tag badge:
159/100 score
19/20 answers
Badges
14 93 162
Newest
 Nice Answer
Impact
~1.5m people reached

Apr
9
revised what to do after suspected intrusion on hobby webserver
edited tags
Apr
9
revised Looking for example of well-known app using unsalted hashes
edited tags
Apr
9
comment Web Security Cheatsheet / ToDo list
+1, OWASP Top 10 is definitely the place to start.
Apr
9
revised Can RSA (or any public/private key algorithm) be repeated for large amounts of data?
edited tags
Apr
9
comment What should I look at in the event of a major vendor suffering compromise with unspecified impact?
+1, even though you mentioned "six sigma" in a non-derogatory fashion... :)
Apr
9
comment Is clipboard secure?
@Ormis, thanks - apparently it's called a Freehand Circle :)
Apr
8
revised What should I look at in the event of a major vendor suffering compromise with unspecified impact?
spelling
Apr
8
comment Naming convention based exploits
@Tathagata ah no, sorry. But I would suggest also looking at (corporate) email addresses, if you have a large enough database... Not 100%, but there will be some correlation.
Apr
8
comment What should I look at in the event of a major vendor suffering compromise with unspecified impact?
+1 for getting to the point much more succintly than I. But I would point out that there are possible scenarios where the worst case scenario can be worse than what you described, where the attackers can use the system AGAINST you, outside the scope of that system's responsibility. Hypothetically, this would be comparable to the case if the attackers that compromised SecurId could make your token explode in your hand. More realistically, consider an antivirus product, that accidentally opens up a backdoor in the system - its not just not AV scanning, it makes it worse than if it wasnt there.
Apr
8
comment Moving from a one tier to a two tier Microsoft Certificate Authority hierachy
Tolja @Iszi ;-)
Apr
8
answered What should I look at in the event of a major vendor suffering compromise with unspecified impact?
Apr
8
answered Is clipboard secure?
Apr
8
comment Is clipboard secure?
Also, even if you do copy the password to the clipboard, PasswordSafe ensure removing it from memory after a short time, e.g. when it gets minimized.
Apr
8
comment Moving from a one tier to a two tier Microsoft Certificate Authority hierachy
@Iszi, I dont think that's necessary. If @Brad really wants to, he can crosspost there (should also crosslink them, too) - but its definitely a good ontopic question here; even though there are sysadmin/operational aspects, I think it tips heavier towards proper crypto management (especially part2). Besides, it's only been 5 days - not everybody jumps on here every day :).
Apr
8
comment Naming convention based exploits
it's better off not to include shortener links (e.g. bit.ly), especially on a security site - users here are sensitive to that, and usually prefer seeing where they are clicking. Fixed the link for now.
Apr
8
revised Naming convention based exploits
fixed shortlink
Apr
7
answered Naming convention based exploits
Apr
7
comment What are the chances to generate the same ssh key?
Oh I see it all the time. Just usually not so counter-productive, and also not so high-profile...
Apr
7
comment What are the chances to generate the same ssh key?
hehe, you're referring to Debian...? :D
Apr
7
revised Generating one-time tokens from API-key?
edited tags