Reputation
41,128
Next tag badge:
159/100 score
19/20 answers
Badges
14 94 163
Newest
 Nice Answer
Impact
~1.5m people reached

1d
comment Are SSL browser sessions kept alive across requests?
@NeilSmithline that's... that is... huh. That is very odd. In Wikipedia's OSI entry, it specifically does note that it is a conceptual model only... Weird. Perhaps we should update that Wikipedia article...
2d
comment Threat modeling
Why do you say that there is more risk with the installation of an antivirus? Because an antivirus is software. Software can have bugs. Bugs can enable threats. If an antivirus is deemed to be a reliable security mechanism, what is? Well, not getting in to whether or not its good (I don't like it for most issues, but it has value). Point is even a GOOD security mechanism is still software. How would you model security mechanisms? Same as any other software. Of course, in addition to whether or not it actually mitigates the intended threat, but also if it introduces any new ones.
2d
comment Are SSL browser sessions kept alive across requests?
Aww that was a great answer up until the very last paragraph.... You're wrong there, SSL/TLS is NOT in layer 6 of the OSI model. Do you know why? BECAUSE SSL/TLS IS NOT AT ALL IN THE OSI MODEL. Oops, sorry for shouting, but the OSI model is not used, it is not even real, it is merely a "conceptual model". TCP/IP is a complete separate, if vaguely similar, model to OSI. </nitpicking> I just wish people would stop saying OSI when they mean "layers of the TCP/IP stack"... ;-)
2d
comment Threat modeling
@Motivated Antivirus is typically considered a security mechanism, however as we've seen lately - if you install a popular antivirus on your machine, you've added more risk than you mitigated. By simply installing the AV, you've put your entire OS in danger. Generally speaking, any functionality - security features included - could potentially introduce new threats. That is why it is important to threat model your security mechanisms too.
2d
comment Can I read the domain name from HTTPS before SSL handshake?
Comments are not for extended discussion; this conversation has been moved to chat.
Feb
9
comment Hoomomorphic encryption for e voting
I'm voting to close this question as off-topic because we are not a source code outsourcing service.
Feb
2
comment My school wants to keep the details of our door authentication system a secret. Is that a good idea?
@PyRulez I added a comment or two, such as they are... Though my intent wasn't a point-by-point rebuttal of other answers, but to contrast both sides of the obscurity/opensource debate...
Jan
26
comment HTTP HEAD and its security versus operational uses
Very good answer here already, so I won't mark it as duplicate, however you might find this interesting too: security.stackexchange.com/q/21413/33
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@Zibbobz But that's the point - a good password should not be able to be broken by an algorithm. That is why password strength is not at all about your creation algorithm, but ONLY about entropy.
Jan
23
comment Is the BBC’s advice on choosing a password sensible?
@msouth pffftt.
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
-1 for saying its not bad advice, but +1 for pointing out the resulting commonalities from a limited set of likely favorites, and preferring a password manager...
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
Bottom line and in short - very bad advice.
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
Also, this is pretty much a duplicate of several questions here. I will find one that is closest, then it will probably get closed as duplicated :-(
Jan
20
comment Is the BBC’s advice on choosing a password sensible?
First of all you didn't follow their advice - they specifically said a musical artist, of which Bieber is neither.
Jan
19
comment Is keeping business data in browser database websql secure?
A full answer would need to be longer, but you should note that WebSQL is obsolete and deprecated for over 5 years now, and you should not ever be using it for anything at all. Definitely not sensitive data. That said, there are other alternatives, such as IndexedDB and LocalStorage - for these, you would need a fuller answer.
Jan
18
comment How to Securely Implement a “Remember Me” Feature?
My answer is incomplete and has a nontrivial flaw, in some situations - please see @Scott's answer, security.stackexchange.com/a/109439/33 .
Jan
18
comment How to Securely Implement a “Remember Me” Feature?
Thanks @scott - it took me a while to grok the importance of the timing attack here, but now I see you are correct! Also agree on the other points for the most part, but I'm not sure that's the way I intended it anyway :-). But yeah, the timing attack does make a load of sense, and all the difference!
Dec
29
comment Block chaining modes to avoid
@tylerl that's really surprising, I reviewed OpenSSL for a project back in 2008, using CTR mode. How is (was?) your package so horridly out of date?
Dec
21
comment What does the Juniper backdoor actually allow an attacker to do?
@Phizes well yeah, that's the point of the question though...
Dec
20
comment What does the Juniper backdoor actually allow an attacker to do?
But, that's just on the Juniper box, right? How does this actually affect servers in the protected network, the business systems, etc?