13,324 reputation
22948
bio website
location
age
visits member for 3 years, 3 months
seen 33 mins ago

Security, Unix, and Networking jack-of-all-trades, master-of-some.


1h
reviewed Close Passwords: Symbols and length > 20 disallowed
6h
reviewed Close facebook login notification: Correct ip but wrong browser info
6h
reviewed Close Should I remotely store my salt?
6h
answered Best practice to secure an API of unknown structure that can come from end user device or server
11h
awarded  Famous Question
23h
reviewed Close How did he get my telephone number?
23h
reviewed Close /tmUnblock.cgi in access.log but not in error.log (no one 404 error is normal?)
23h
reviewed No Action Needed it is possible to decrypt HTTPS with the (private, public) pair if it uses DHE?
1d
comment Why doesn't Google Safe Browsing block the IP addresses of malicious websites?
@AhmedElsobky, if Safe Browsing domain name blocking had even the slightest hint of discrimination, then I would agree they might do that. But the existing blocking is so heedlessly broad I feel there's little chance of that. (And, yes, I speak as someone whose business was blocked across the board by Safe Browsing because of the compromise of a minor brochure-ware site which was hosted at a different ISP and was completely and totally separate from the other innocent systems that got blocked.)
1d
comment How do I set up SSL on my NearlyFreeSpeech site via StartSSL?
Ha. StartSSL is going to have to change their name to StartTLS. Not sure if that's irony or serendipity...
1d
reviewed Looks OK Nmap scan list of domains and provide boolean if up/down
1d
answered Why doesn't Google Safe Browsing block the IP addresses of malicious websites?
2d
answered Why is TLS_FALLBACK_SCSV secure against a MITM attack?
Oct
18
awarded  Good Answer
Oct
17
comment SSLv3 cannot be disabled, can I use weak cipher as a workaround?
That article is from 2012. Since then they've robbed Newegg but lost to Intuit. I think it's clear that only people with really deep sue-worthy pockets need to worry about this patent troll, and even those people can leaven their fear with assurance that it's just a troll.
Oct
17
answered Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?
Oct
17
answered SSLv3 cannot be disabled, can I use weak cipher as a workaround?
Oct
17
comment Web site accepting authentication via GET
@vsespb attacker can do that via GET or POST. Again, no difference unless app doesn't parse GET, in which case it either denies login (correct) or completely screws up and grants login - at which point the problem of a program handling bad input is the problem, not GET or POST.
Oct
17
comment Web site accepting authentication via GET
Okay, in that case this just makes no sense at all. If the attacker can glean the credentials, they can use GET or POST, either way. If the server side code handles GET and POST data equivalently, no difference. If it doesn't handle GET because it expected POST, then it's like a blank submission, no problem. What "hidden GET image on attacker's site" do you imagine is going to magically grab credentials from the user's browser? It doesn't work that way.
Oct
17
comment Web site accepting authentication via GET
It's still about the difference between GET and POST for web application security, whether it's you designing it or the attacker manipulating it.