Reputation
313
Top tag
Next privilege 500 Rep.
Access review queues
Badges
1 8
Newest
 Caucus
Impact
~12k people reached

Mar
11
revised How to find out what programming language a website is built in?
indices -> indications
Mar
11
suggested approved edit on How to find out what programming language a website is built in?
Sep
5
comment Are case-insensitive passwords a bad idea?
if you can log in with caps lock on that means you are not using symbols or numbers...
Aug
3
revised Is this an attempted SQL injection?
coded the thing
Aug
3
suggested approved edit on Is this an attempted SQL injection?
Jul
20
awarded  Caucus
Jul
14
awarded  Nice Answer
Jul
12
answered Why not mix hashes?
Jul
12
comment Why not mix hashes?
my take on progs.SE
Apr
21
awarded  Citizen Patrol
Mar
24
comment Is Clickjacking a real security vulnerability?
The browser will send good.com cookies if third-party cookies have been allowed, by default (in firefox at least) they are and if they are blocked you can't comment on your favorite cat videos.
Mar
12
comment Is it legal to start a private website for you and your friends to hack?
@Lohoris then don't use the word and instead use "extended penetration tests".
Mar
5
comment Technology that can survive a “Rubber-Hose attack”
Any system where only 1 person is needed to get access is vulnerable to the rubber hose, you can torture someone to go through the steps of decryption.
Feb
11
comment What is a good way to authenticate a user to a smart phone?
Pin can be made more secure by limiting the number of tries before defaulting to the longer password
Jan
26
awarded  Editor
Jan
26
revised REST API security
added 176 characters in body
Jan
26
comment REST API security
an active MitM where the server is replaced yeah, that needs a separate authentication (signing the responses of the server for example). And replay will only work as long as the ID remains valid.
Jan
26
comment Extract a key from an AES black-box?
well technically if you can send 2^(key length) plaintext to be encrypted then you can extract the key by pure brute force, just not until the universe has died
Jan
26
comment REST API security
@wireghoul The users want to use it over a wifi where https is blocked.
Jan
26
answered REST API security