meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 8 months |
| seen | 6 hours ago | |
| stats | profile views | 301 |
|
May 15 |
comment |
Are CSRF Attacks Really Blind What should parse as CSS (according to std), exactly? I have really no idea. What does parse as CSS, in real world browsers? What might parse in the future? I am not sure. I am just unsure, and it is unpleasant. The mere fact that I might have to worry about a potential, unlikely, problem is annoying. I like to be able to make security proofs not rely on how unlikely it is that something sensitive might parse as CSS, someday. |
|
May 15 |
comment |
Are CSRF Attacks Really Blind "stylesheet, but can't programatically access its contents" Can't you get the "computed" style of your own page elements? That would tell you something about the included CSS. |
|
Apr 8 |
awarded | Nice Answer |
|
Apr 1 |
comment |
Does “loose source and record route” drop the source address? +1 for mentioning using loose source routing for stateless "NAT" |
|
Mar 29 |
comment |
Security issues with allowing Dropbox installations on client PC's in our organisation "Payment Card Industry (PCI) Standards says so" why would you even want to handle Payment Card data? That is the job of banks and other specialized payment operators! IMO most company should not even think about handling these sensible information themselves. If they do, it should be on isolated computers, such that file sharing software can be installed on other computers without any risk for payment data. |
|
Mar 29 |
revised |
Does “loose source and record route” drop the source address? edited tags |
|
Mar 29 |
revised |
How do browsers know which cookie to get? edited tags |
|
Mar 21 |
comment |
Does Google Chrome protect against cross site scripting (XSS)? XSS prevention in browser is a potentially very dangerous feature if it blocks specifics scripts classified as XSS, if these scripts have security sensitive functions. |
|
Mar 6 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @culix "Does that make sense?" It does. But how do you know you have logged out? |
|
Feb 12 |
awarded | Notable Question |
|
Feb 1 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @LieRyan "If the device is compromised, the bank can simply issue a new device with a new seed" I mean if the device you use to connect "securely" to your bank. "And the danger of compromising an active session always exists whatever auth method you use, so what's your point?" My point is that a compromise of your computer is probably the most likely practical threat. |
|
Jan 30 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? But two factors auth does not protect your session. |
|
Jan 30 |
comment |
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers? @LieRyan If the device is compromised, there is no guarantee. Even if a password is not compromised, there is a valid session that can be misused directly. |
|
Jan 28 |
revised |
Can a SMS recipient charge any arbitrary fee to the sender without approval? edited tags |
|
Jan 23 |
comment |
How is a worm different from a virus? @GrahamHill An existing boot loader certainly counts as an existing program. What about a boot "virus" that installs itself on a floppy disk that was not bootable? |
|
Oct 5 |
revised |
How is user authentication sent in a public wifi? Radius/802.1x/EAP etc edited tags |
|
Sep 24 |
awarded | Yearling |
|
Sep 21 |
awarded | Custodian |
|
Sep 15 |
awarded | Fanatic |
|
Sep 14 |
comment |
XSS : Blacklist characters vs. whitelist "You may even try if a mailserver accepts the user (Gmail will error when a user does not exist, even before you really sent anything)" do you suggest verifying email validity with RCPT TO instead of the command intended for this (VRFY)? |
