Reputation
21,229
Next tag badge:
80/100 score
26/20 answers
Badges
20 122 315
Impact
~1.4m people reached

Aug
22
comment Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)
@NobuGames This could be a valuable answer, and not subject to deletion or non indexing as a comment. Why is OpenJDK better? How does it compare? Would there be support issues if I used it with Android? (or Xamarin for that matter?)
Aug
22
asked Is there a list of web technologies, and the corresponding privacy risks and mitigations?
Aug
21
revised Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)
edited tags
Aug
21
asked Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)
Aug
21
awarded  Popular Question
Aug
21
awarded  Announcer
Aug
19
comment How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?
I'm on Safari and can't translate that page, so yes a summary would be nice. Also this describes more about the original android vulnerability blog.lookout.com/blog/2010/12/09/android-touch-event-hijacking
Aug
19
revised How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?
added 20 characters in body
Aug
19
asked How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?
Aug
19
comment How to prove ownership of a website?
SSLStrip and other hacks can trick even the sophisticated user. When using a mobile device, no SSL icon is visible, further worsening the security position.
Aug
19
comment How to prove ownership of a website?
You're referring to a variant of SiteKey, which is "Security Theatre" - security.stackexchange.com/a/26380/396
Aug
18
awarded  Notable Question
Aug
18
awarded  Good Answer
Aug
16
comment P12 - Extract public part (certificate) without knowing the p12 password
if any part of it is readable, this site might help (not sure if P12 is ASCII or binary : lapo.it/asn1js
Aug
14
comment Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?
... otherwise the client might be carrying around "system state" from ASPX days. msdn.microsoft.com/en-US/library/ms178581.aspx ... by the client choosing the data to post, they are in fact defining their existence to the server in its entirety
Aug
14
comment Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?
Perhaps I should be more clear in my intent. I have a custom privacy preserving TCP client that mostly does HTTP/1.1 actions. Since this is residing in an EXE I want to redefine the authentication mechanism to be more private that what is currently available. Privacy is my key selling point. The problem I have with the POST and the cookie is that the SERVER assigns the value. When this assignment happens, it might correlate to other backend data. By the client choosing the bearer token value, then the client knows what it's carrying around in a blob..
Aug
11
answered Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?
Aug
11
comment Is there a vulnerability when TLS is decrypted, then encrypted with OpenSSL that is vulnerable to BEAST or CRIME?
Thank you. I asked this because I was rethinking this answer, and wondering if the load balancer to web server unencrypted vs a vulnerable SSL is more or less risky.
Aug
10
comment PKI usage in a cluster; per application instance or per application?
Regarding private keys not traveling, what about email signatures? Or decryption of inbound emails? Keys need to be on multiple devices (phone, work, kiosk, etc).
Aug
10
accepted Is there a vulnerability when TLS is decrypted, then encrypted with OpenSSL that is vulnerable to BEAST or CRIME?