188 reputation
7
bio website
location
age
visits member for 2 years, 11 months
seen Jul 22 at 14:43

Jun
6
comment How can I secure my wireless network from neighbor's password-cracking attempts?
Is this a real neighbor or a hypothetical neighbor?
May
27
awarded  Editor
May
27
revised Is it good practice to ban an IP address if too many login attempts are made from it?
spelling in title and question
May
27
suggested suggested edit on Is it good practice to ban an IP address if too many login attempts are made from it?
Aug
13
awarded  Commentator
Aug
13
comment Is it safe to show users why their password is not allowed?
You might want to revise your checking for a better experience. Lets say I enter a password woot. That will fail because its too short. Then I do wootwootwoot. Now it fails because it has no numbers. Then w00twootwoot, fails no capital. Then W00twootwoot, fails no symbol. At which point unless I have to log into your application to do my job I'm going to throw a fit and go do something else. Revise your checking to tell me all of the password requirements up front and make the validation tell me all of the missing requirements if I don't hit them.
Jul
5
comment Prevent my site from being copied
"NDA, (or similar) that says they won't extract or copy information from your site." - This is laughable. How are you going to enforce such a contract? Will your users tolerate it?
Mar
6
comment Is it possible to locate Tor/proxy users? Spam is getting on my nerves
@asadz - No solution is perfect. Modern CAPTCHAs exist to both prevent automated spamming and to slow down manual spamming. Suppose our OP is getting 1000 spam messages and it takes 2 seconds per message, 2000 seconds. Now add a CAPTCHA that adds an extra second per post, thats 3000 seconds (~15 minutes). Throttling posts by IP or user has a similar effect. Now this strategy also affects legitimate users, but a legit user pays a lesser penalty because they only post a few messages or can authenticate.
Mar
6
answered Is it possible to locate Tor/proxy users? Spam is getting on my nerves
Feb
15
comment How can I protect against email tracking services?
This should be doable with other services and email clients as well.
Dec
13
comment Why don't people hash and salt usernames before storing them
Actually you could. After a successful login store the unhashed username in the session.
Nov
28
suggested suggested edit on VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
Nov
20
awarded  Critic
Aug
30
comment How can attackers bypass firewalls?
Wikipedia hardly constitutes a source for detailed information about how firewalls work.
Aug
29
comment Dealing with excessive “Carding” attempts
"As one is declined they usually try it again repeatedly changing the card number by 1 or 2 numbers" - This doesn't sound right. CC numbers are self-checksummed using the Luhn algorithm. I think you'd need to change more than one or two digits to get a valid number. At any rate, you can limit these attempts by having your site also do a checksum validation of any card entered. It will help usability too, this is designed to prevent miskeying a number.
Aug
27
awarded  Supporter
May
1
awarded  Teacher
May
1
awarded  Student
May
1
awarded  Scholar
Feb
10
accepted What is the term to use when logging an event where a user downloads or prints PHI?