53,807 reputation
17130221
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
18
reviewed Approve What is the difference between an x.509 “client certificate” and a normal SSL certificate?
Jan
18
comment HTTP Response Splitting
It would be considered very serious if you were able to attack the response, but if you can only attack the request it's much more of an "it depends", in that it requires a second vulnerability in order to exploit anything properly. Either way, you should fix splitting bugs if you find them.
Jan
18
answered HTTP Response Splitting
Jan
18
comment HTTP Response Splitting
Firefox fixes it by disabling the javascript: handler entirely for the address bar. Anyway, this doesn't answer the question.
Jan
17
comment How about preventing CSRF this way?
@George Of course they can. Httponly just stops the cookies being accessed by JavaScript - any cookie editing addon for a browser will let the user change the cookie.
Jan
15
awarded  Enlightened
Jan
15
awarded  Nice Answer
Jan
15
reviewed Approve Are passwords stored in memory safe?
Jan
14
comment Reporting a GMail hacker attack
It's the only way to be sure.
Jan
14
comment Any recipient can modify an order confirmation mail, right? Does this ever matter ?
@DanNeely But in that event you have recourse to demonstrate good faith on your behalf, in case the customer comes crying to you.
Jan
14
comment Pseudo-Unique PICC Identifier in Passports/ID Cards
I would imagine that "a diversified fixed number" could mean a counter. As long as there are <2^32 cards, it's feasible that there are no duplicates.
Jan
14
comment Any recipient can modify an order confirmation mail, right? Does this ever matter ?
@CodesInChaos Because, in general, "John from Accounts" isn't going to have a clue what PGP is, let alone how to verify the signature's authenticity.
Jan
14
answered Any recipient can modify an order confirmation mail, right? Does this ever matter ?
Jan
14
comment Any recipient can modify an order confirmation mail, right? Does this ever matter ?
Interesting. I can think of a few issues, but I'll write up an answer.
Jan
14
comment Any recipient can modify an order confirmation mail, right? Does this ever matter ?
This sounds like you're trying to rationalise not doing a particular bit of work. Care to explain the context behind this question?
Jan
14
comment secure credit card transactions on the internet
Whilst I'd be extremely interested in this, I fear it might end up being classed as a list question and closed.
Jan
14
reviewed Reject What should be Database encryption strategy ?
Jan
14
comment Will disabling the Java add-on in IE protect you from Java exploits?
Nice, didn't know about that new feature. Kinda funny that they had to add such a switch to their product as a result of all the 0days, though.
Jan
14
revised Will disabling the Java add-on in IE protect you from Java exploits?
added 15 characters in body
Jan
14
answered Will disabling the Java add-on in IE protect you from Java exploits?