Reputation
Next tag badge:
593/400 score
74/80 answers
Badges
17 146 240
Newest
 Nice Answer
Impact
~2.3m people reached

Jul
10
awarded  Nice Answer
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
Right. You can just change session.gc_maxlifetime to a larger timeout. The problem described there is that you shouldn't rely upon the PHP GC to time out your session on the server side, because it may not do so immediately after the configured time. It should never time it out before that time.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
"PHP session limit"? What session limit? The session cookie expiry can be set at any value, including forever. Besides, if the session no longer exists, they should be logged out, which is a totally different issue.
Jul
1
revised Tor website HPKP (key pinning) failure
Title / grammar / various edits
Jul
1
comment What is the difference between a hash table and a rainbow table, and how are they both used?
Simple answer: rainbow tables chain similar hashes together to save space, by not storing the prefix for every hash. (e.g. f2ca5152b0..., f2ca513a13..., and f2ca5177b8... can be stored as f2ca51 -> 52b0..., 3a13..., 77b8... since they share the same prefix).
Jun
30
awarded  Popular Question
Jun
30
reviewed Edit Is the SanDisk ULLtraDIMM secure after power-down?
Jun
30
revised Is the SanDisk ULLtraDIMM secure after power-down?
Making it more readable by creating paragraphs
Jun
30
comment Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?
@YvesMartin No, it's not too short at all. Brute-forcing a 256-bit key with conventional computers would take more energy than is thought to exist in the universe. The reason RSA keys are longer in numerical size is that they represent primes rather than just any old random number, and the mathematics involved to crack RSA means we (currently) need keys in the order of 2048-bits or larger to remain safe.
Jun
29
answered Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?
Jun
29
comment DDOS Server Attacks & Domain Names
Assuming you have control over your NS records (e.g. in your domain provider's control panel), you could just use CloudFlare's free DDoS protection.
Jun
18
comment Is it any more or less secure to delete all my cookies vs. individually logging out?
To be clear: deleting your cookies alone (or first) is a bad idea, as the session might still persist on the server. Best option is to log out, then delete any remaining cookies.
Jun
18
answered Safely sharing session accross sub-domains
Jun
15
revised How to distinguish between a scam and a genuine call?
edited tags
Jun
15
comment How to devise a security policy?
@JohnnyUtahh Thanks for the heads up. Fixed the links.
Jun
15
revised How to devise a security policy?
fixed dead links
Jun
15
comment How to devise a security policy?
@JohnnyUtahh There's certainly overlap on the Venn diagram, but they're not the same. A usage policy governs how employees should conduct themselves when using IT systems (e.g. no naughty images via work internet access). A security policy also has elements of conduct (e.g. no dodgy sites, cracked software) but is usually much larger in scope, such as giving procedures and contact information for security incidents, and may be broader in scope than just IT (e.g. handling of physical media, documents, etc.)
Jun
15
comment What is the purpose of using different DNS server in nmap?
@biziclop In that particular case I'd be using dig rather than nmap, but you are correct that it can be done that way.
Jun
15
answered What is the purpose of using different DNS server in nmap?
Jun
12
comment How is Gmail susceptible to brute-force attacks?
"so if it didn’t leak from some other site" is the key part here. It's very likely she re-used her password elsewhere and it got compromised.