311 reputation
18
bio website
location
age
visits member for 3 years, 10 months
seen Jul 27 at 15:20

Jul
20
awarded  Caucus
Jul
14
awarded  Nice Answer
Jul
12
answered Why not mix hashes?
Jul
12
comment Why not mix hashes?
my take on progs.SE
Apr
21
awarded  Citizen Patrol
Mar
24
comment Is Clickjacking a real security vulnerability?
The browser will send good.com cookies if third-party cookies have been allowed, by default (in firefox at least) they are and if they are blocked you can't comment on your favorite cat videos.
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
@Lohoris then don't use the word and instead use "extended penetration tests".
Mar
5
comment Technology that can survive a “Rubber-Hose attack”
Any system where only 1 person is needed to get access is vulnerable to the rubber hose, you can torture someone to go through the steps of decryption.
Feb
11
comment What is a good way to authenticate a user to a smart phone?
Pin can be made more secure by limiting the number of tries before defaulting to the longer password
Jan
26
awarded  Editor
Jan
26
revised REST API security
added 176 characters in body
Jan
26
comment REST API security
an active MitM where the server is replaced yeah, that needs a separate authentication (signing the responses of the server for example). And replay will only work as long as the ID remains valid.
Jan
26
comment Extract a key from an AES black-box?
well technically if you can send 2^(key length) plaintext to be encrypted then you can extract the key by pure brute force, just not until the universe has died
Jan
26
comment REST API security
@wireghoul The users want to use it over a wifi where https is blocked.
Jan
26
answered REST API security
Dec
8
awarded  Yearling
Dec
5
answered Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?
Nov
25
comment Can a lock picker slowly undermine the security of a deadbolt door?
@Clockwork-Muse a well placed foot will get you into many buildings, for everything else there is the rubber hose to the security guard method
Nov
9
comment Should security-critical code be reused or rewritten?
@ChrisCirefice except when the code practices are ripe for backdooring like with heartbleed
Oct
29
comment Why do I need to hide my phone's IMEI
same reason why you would want to blur your license plate when distributing pics of your car