Reputation
37,793
Next tag badge:
153/100 score
19/20 answers
Badges
14 88 160
Newest
 Nice Answer
Impact
~1.3m people reached

23h
comment Is a random work factor an increase or decrease of security?
@TomLeek I think I was explicit enough about this being handwavey, and not strictly accurate. On the other hand, the OP did specify that the defender does not know X.
1d
comment What is the purpose of this malware code?
This doesn't at all look like clickjacking, iframe embedding would usually be the other way around, no?
1d
comment Crossdomain.xml vulnerabilities
To be fair, @rook is absolutely correct: crossdomain.xml and CORS are completely different, unconnected mechanisms, even though they share some philosophical ancestry. Though they serve similar purposes, and both are related to granular bypassing of SOP, they are still completely different implementations, different design, different details, and different targets. I think you should remove this answer - not because it's wrong, but because it is completely unrelated to the question.
Aug
26
comment Active directory authentication and authorization for an application
@Stephane this is not a coding question, so it doesn't belong on Stackoverflow. It is a question of security architecture and design, so it does belong here - however it is a bit broad and difficult to give a complete answer... Perhaps if Pang can focus the question better?
Aug
25
comment Legality of scanning a site with SSLLabs SSL Server Test in order to find and report weaknesses
IANAL, and as the other comment says we can't really answer legal questions per se. However, it's not really a question of legality since SSLLanbs doesn't actually scan the site - it just parses the certificate, protocol headers, and etc, and displays the results. Yes, it might make several connection attempts, but these are ALL publicly visible, and in fact what your browser actually uses each time it connects. So, there is really not any legal question here, but again IANAL.
Aug
23
comment How to sell a new idea – “100% secure communication”, feedback wanted
Also, challenges of the form "decrypt this encrypted message" are a sure sign that you are not understanding the basics of how cryptanalysis, and cryptography in general, work. Start by looking up Kerkchoffs Law.
Aug
23
comment How to sell a new idea – “100% secure communication”, feedback wanted
Also, is your solution TLS? If it's not, why not use TLS? If you don't understand the benefits - and the problems - of TLS (or any of the other existing cryptoprotocols), then you are guaranteed that you are either doing it wrong, or doing it oh so very, very wrong.
Aug
23
comment How to sell a new idea – “100% secure communication”, feedback wanted
Is there a question here?
Aug
18
comment Online Marketing company want me to share my Google Account login details?
Can you not create a new account (in your google apps domain) for the marketing company, and give that account access to the MyBusiness and other company Google+ pages? (I am not familiar with those services...)
Aug
18
comment Online Marketing company want me to share my Google Account login details?
See also my answer at Is it OK to tell your password to your company's sysadmin?. Different context, same answer - passwords are NEVER to be shared.
Aug
16
comment How to ensure message integrity for ciphers created via RSA algorithm
Are you asking, what are the methods I need to call to perform an integrity check? If that is your question, then I agree that it should be migrated to SO. On the other hand, if you're asking, what is the right way to do this - then it should not be migrated, it would be answered here. (Hint: Just use TLS.)
Aug
16
comment XKCD #936: Short complex password, or long dictionary passphrase?
@Cyberherbalist It's not about having haters, it's about being a better marketer than anything else, even if he doesn't understand the words he is repeating out of context, or making up altogether. But here is really not the place for a discussion on his expertise...
Aug
6
comment A fledgling idea: Relational Encryption
Finally: Schneier's Law states that "Any person can invent a security system so clever that he himself can't imagine a way of breaking it." The trick is to make it so that no one ELSE can break it... ;-)
Aug
6
comment A fledgling idea: Relational Encryption
Third: I strongly urge you to read up on the basics of modern cryptography. One doesn't simply create a new encryption algorithm, especially not without a strong, extensive background in existing methodologies (and even with that, peer review over several years...). At the very least, you have a basic key management problem - which is, unless you have a passphrase as long as the text you want to encrypt, it is trivially breakable, and if it IS that long, well then you have the confidentiality problem all over again...
Aug
6
comment A fledgling idea: Relational Encryption
Hi Andrew, welcome to Information Security! First comment I have - is there a question here?
Jul
31
comment Do card issuers give merchants new expiry dates for recurring payments?
"expiration date" - are you talking about e.g. credit cards?
Jul
31
comment Is this code javascript vulnerable to DOM based XSS?
The simple answer is: it depends. Depends on a lot of information not present in the question, and is not possible to include in the question.
Jul
31
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
@begueradj I absolutely agree with you on that, except that usually it doesn't help but hinders. That's why I said your first 3 sentences are great, the rest is misleading and confusing (besides being technically wrong...)
Jul
31
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
It has been pointed out (see comments) that the OSI model is an over-generalisation and does not fit very well here. This is true. However, the use of this model is to demonstrate that SSL sits "somewhere" in between TCP and HTTP. It is not strictly accurate, and is a vague abstraction of reality.
Jul
31
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
begueradj, SSL doesn't act on ANY layer of the OSI model, and neither does TLS - because they do not use the OSI model. Despite the misleading comment from Wikipedia that @Scott posted.