726 reputation
410
bio website kaeding.name
location Boston, MA
age 33
visits member for 4 years, 6 months
seen yesterday
I am a software developer living in Boston. When I'm not on the computer, I may be brewing beer.

May
19
awarded  Nice Question
May
13
awarded  Scholar
May
13
accepted Why is EC2 not vulnerable to VENOM?
May
13
awarded  Student
May
13
asked Why is EC2 not vulnerable to VENOM?
Apr
23
comment Why don't we reward users who choose strong passwords?
Some banks do incentivize customers to use multi-factor authentication by lifting limitations.
Mar
19
revised How do I recover from an email breach?
elaborated on 2FA, filters
Mar
19
answered How do I recover from an email breach?
Jul
15
awarded  Yearling
May
5
awarded  Nice Answer
May
2
answered Can someone explain the “Covert Redirect” vulnerability in OAuth and OpenID?
Dec
5
awarded  Enlightened
Dec
5
awarded  Nice Answer
Nov
22
awarded  Yearling
Nov
22
awarded  Yearling
Aug
14
awarded  Nice Answer
Jun
1
comment How can I ensure that I connect to the right wireless Access Point?
@Bill Weiss, I think @Rakkhi meant FireSheep, which would allow the attacker to easily grab the passing login cookies, and impersonate the victim on many websites that don't use HTTPS for all their traffic.
Feb
18
comment What is your way to create good passwords that can actually be remembered?
@StasM, yeah, I have also abandoned this method, as a matter of fact. I now forget about trying to remember passwords, since it is not practical to have a secure password, that you don't use in multiple places. I now use a password management program (1Password is what I use, but there are others that are probably just as good). So, I just remember one secure password, and I type that into 1Password. 1Password remembers all my passwords, and generates new ones randomly when I need a new one.
Dec
22
comment Security review: “HTTP header user-agent has been set to (something)”
I believe that @rox0r is saying that Header data should be treated like any other user submitted data, such as form data, etc. You need to deal with it carefully to avoid SQL injection and XSS vulnerabilities. This doesn't mean you need to disallow requests from user-agents with weird values, but you just need to take the necessary precautions to be sure you don't use that data in an unsanitized manner.
Nov
30
answered Persisting and comparing NMAP scans