Reputation
13,822
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
3 48 98
Impact
~1.0m people reached

8h
awarded  Notable Question
Jan
13
comment How can we accurately measure a password entropy range?
Thanks @AlexisWilke! I updated the answer.
Jan
13
revised How can we accurately measure a password entropy range?
update as noted by Alexis Wilke
Nov
23
awarded  Yearling
Sep
23
revised Should websites be allowed to disable autocomplete on forms or fields?
clarify which comment BenB made
Sep
13
awarded  Notable Question
Sep
7
accepted Examples of “Runtime application self-protection” (RASP) in action?
Sep
7
revised Examples of “Runtime application self-protection” (RASP) in action?
better link text
Sep
4
awarded  Notable Question
Jul
23
awarded  Caucus
Jul
4
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
Can you consolidate your answer to lead with the variety of ratings, which really helps inform our speculation about why they make these choices? Also, since there are 4 distinct attacks, I suppose they might come up with a rating for each.... Then I'll accept it. Thanks for the very helpful research!
Jul
4
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
Interesting also that SCIP ranks it as "high" access complexity. That may apply to the Integrity and Availability scores they give, and I suppose that for a time it might apply to the Confidentiality score. But it seems to me that the best scoring is by Polycom, IBM and Redhat: (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
Jul
2
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
@StackzOfZtuff Wow - fascinating. And IBM rates it as I:N also (no integrity impact), which may reflect an assessment that it is much harder to get MITM there, IIRC.
Jun
30
asked Why is logjam rated as “None” for confidentiality impact in CVSS?
Jun
30
comment How to check if a server is not vulnerable to Logjam?
Thanks for trying to be helpful :) Perhaps you could update your answer to clarify what those sites are saying.
Jun
2
awarded  Favorite Question
May
30
awarded  Necromancer
May
29
answered Do security questions subvert passwords?
May
25
comment Does DNSSec have any benefit if used with IPSec-enabled IPv6?
@Pacerier Yes - thanks for the prompt. I updated the answer
May
25
revised Does DNSSec have any benefit if used with IPSec-enabled IPv6?
kidns => dane and others