Reputation
6,606
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
8 28
Impact
~461k people reached

1d
comment Locking Linux system to work on certain hardware only
@Kozuch: archive.fortune.com/magazines/fortune/fortune_archive/2007/07/…
2d
awarded  Notable Question
Aug
7
answered http_only for cookies with JWT tokens
Jun
24
comment Is there a way to securely store unsalted passwords?
So you will tell applicants when a password already exists in your database. Is this good for security?
Jun
23
comment HTTP status 302 and subsequent redirect
Why? And what would you use to script/record an HTTP interaction?
Jun
22
answered HTTP status 302 and subsequent redirect
May
30
answered Custom CSRF protection mechanism without persisting tokens
May
29
awarded  Nice Answer
Apr
24
awarded  web-application
Apr
2
awarded  Popular Question
Mar
30
revised follow up to previously answered “Escalating from Apache shell to root”
added link to reference source, removed redundant stuff
Mar
27
answered Tracking IP address to prevent abuse without logging user metadata
Mar
26
comment Anti-virus anonymity question
Do you really believe if you use a VPN, don't store cookies and send DNT headers you have privacy?
Mar
26
comment Anti-virus anonymity question
Since we're talking about anti-virus software, then really we're talking about the integration of the AV software with winsock.dll - the AV sits between winsock and the application client - hence has full visibility of the unencrypted datastream. It also has visilibility of hostname lookups.
Mar
24
comment Could an attacker prevent IIS from logging requests
...so you've identified a gap in your ability to detect an attempted attack (yay!)
Mar
17
answered Is there a risk in opening port 22 for ssh access with a network?
Mar
9
awarded  Popular Question
Feb
24
comment security reviews of third party code
Actually, there was a time when Microsoft made quite a big deal out of making their source code available to selected partners for very high licence costs and very strict NDAs - it was really all just theatre when you'd need to spend at least as much as Microsoft spent writing the code to audit it properly.
Feb
20
answered How safe is SSL on an untrusted computer and network?
Feb
19
answered Categories of security when evaluating services and protocols