211 reputation
16
bio website
location
age
visits member for 3 years, 7 months
seen 3 hours ago

Apr
21
awarded  Citizen Patrol
Mar
25
comment What is a “spam seed”?
Like the quesion/answer pair I discussed in this woodworking.meta answer?
Mar
24
comment Is Clickjacking a real security vulnerability?
The browser will send good.com cookies if third-party cookies have been allowed, by default (in firefox at least) they are and if they are blocked you can't comment on your favorite cat videos.
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
@Lohoris then don't use the word and instead use "extended penetration tests".
Mar
5
comment Technology that can survive a “Rubber-Hose attack”
Any system where only 1 person is needed to get access is vulnerable to the rubber hose, you can torture someone to go through the steps of decryption.
Feb
11
comment What is a good way to authenticate a user to a smart phone?
Pin can be made more secure by limiting the number of tries before defaulting to the longer password
Jan
26
awarded  Editor
Jan
26
revised REST API security
added 176 characters in body
Jan
26
comment REST API security
an active MitM where the server is replaced yeah, that needs a separate authentication (signing the responses of the server for example). And replay will only work as long as the ID remains valid.
Jan
26
comment Extract a key from an AES black-box?
well technically if you can send 2^(key length) plaintext to be encrypted then you can extract the key by pure brute force, just not until the universe has died
Jan
26
comment REST API security
@wireghoul The users want to use it over a wifi where https is blocked.
Jan
26
answered REST API security
Dec
8
awarded  Yearling
Dec
5
answered Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?
Nov
25
comment Can a lock picker slowly undermine the security of a deadbolt door?
@Clockwork-Muse a well placed foot will get you into many buildings, for everything else there is the rubber hose to the security guard method
Nov
9
comment Should security-critical code be reused or rewritten?
@ChrisCirefice except when the code practices are ripe for backdooring like with heartbleed
Oct
29
comment Why do I need to hide my phone's IMEI
same reason why you would want to blur your license plate when distributing pics of your car
Sep
19
comment Is email less secure than voicemail, snail mail, or internet portals for transferring sensitive information?
@Xander or they made very conservative suggestions to avoid liability
Sep
15
comment Is the Google address being spoofed on my computer?
* unless the hacker has hijacked your computer and changed the way you see this answer to show his own signature (long shot but if you are paranoid...)
Sep
2
comment Is there a security issue in using the same certificate for all a company's services?
couldn't you have 1 main certificate and use that to sign the publicly viewable certificates (those on the test servers and such),