Reputation
58,920
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.3m people reached

Aug
12
awarded  Guru
Aug
6
awarded  Favorite Question
Aug
6
comment Does ssh-agent store the SSH key passwords in cleartext in the memory?
@kasperd Not necessarily. Evil maid attacks, etc. are common threat scnearios.
Aug
6
comment Does ssh-agent store the SSH key passwords in cleartext in the memory?
@kasperd Right. But if they have physical access, they can just install a hardware keylogger, or a PCI card with memory access, or any other kind of hardware backdoor.
Aug
6
awarded  Popular Question
Aug
1
awarded  Enlightened
Aug
1
awarded  Nice Answer
Jul
24
awarded  Good Question
Jul
15
comment
@Ulkoma Absolutely not. It is an integral part of my love of Metal Gear Solid!
Jul
15
comment
@DeerHunter Kilts are acceptable, of course.
Jul
15
comment
@MikeOunsworth To me, professionalism just means wearing pants.
Jul
15
wiki
Jul
15
awarded  Caucus
Jul
15
comment ASP.NET Machinekey encryption
@Levi Ah, well I shall defer to your knowledge on the matter. Weird though - I'm sure I got that description of behaviour from RE'ing the assemblies.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
@StackzOfZtuff Sorry, I conflated the two.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
"do not forget to define your own DH parameters or all DHE- ciphers are weak" - No, the ciphers are not weak. The use of shared ECDH groups is potentially problematic, and steps should be taken to generate your own parameters, but that doesn't make the cipher weak.
Jul
13
comment ASP.NET Machinekey encryption
@Levi This may depend on which version of the .NET framework you load, and whether you're looking at the desktop or web platform. The info above was derived from reverse engineering the framework assemblies, so I guess we're looking at different versions.
Jul
10
awarded  Nice Answer
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
Right. You can just change session.gc_maxlifetime to a larger timeout. The problem described there is that you shouldn't rely upon the PHP GC to time out your session on the server side, because it may not do so immediately after the configured time. It should never time it out before that time.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
"PHP session limit"? What session limit? The session cookie expiry can be set at any value, including forever. Besides, if the session no longer exists, they should be logged out, which is a totally different issue.