6,525 reputation
728
bio website lampe2e.blogspot.co.uk
location Scotland, United Kingdom
age
visits member for 4 years, 7 months
seen 2 days ago

Jun
24
comment Is there a way to securely store unsalted passwords?
So you will tell applicants when a password already exists in your database. Is this good for security?
Jun
23
comment HTTP status 302 and subsequent redirect
Why? And what would you use to script/record an HTTP interaction?
Jun
22
answered HTTP status 302 and subsequent redirect
May
30
answered Custom CSRF protection mechanism without persisting tokens
May
29
awarded  Nice Answer
Apr
24
awarded  web-application
Apr
2
awarded  Popular Question
Mar
30
revised follow up to previously answered “Escalating from Apache shell to root”
added link to reference source, removed redundant stuff
Mar
27
answered Tracking IP address to prevent abuse without logging user metadata
Mar
26
comment Anti-virus anonymity question
Do you really believe if you use a VPN, don't store cookies and send DNT headers you have privacy?
Mar
26
comment Anti-virus anonymity question
Since we're talking about anti-virus software, then really we're talking about the integration of the AV software with winsock.dll - the AV sits between winsock and the application client - hence has full visibility of the unencrypted datastream. It also has visilibility of hostname lookups.
Mar
24
comment Could an attacker prevent IIS from logging requests
...so you've identified a gap in your ability to detect an attempted attack (yay!)
Mar
17
answered Is there a risk in opening port 22 for ssh access with a network?
Mar
9
awarded  Popular Question
Feb
24
comment security reviews of third party code
Actually, there was a time when Microsoft made quite a big deal out of making their source code available to selected partners for very high licence costs and very strict NDAs - it was really all just theatre when you'd need to spend at least as much as Microsoft spent writing the code to audit it properly.
Feb
20
answered How safe is SSL on an untrusted computer and network?
Feb
19
answered Categories of security when evaluating services and protocols
Feb
14
revised PHP Plugin Security
typos
Feb
14
comment PHP Plugin Security
While I don't really want to encourage people to try this unless they know what they are doing....yes there are lots of ways to obfuscate and even encrypt code, but there are only a few ways to get php to execute code (popen, exec, et all, create_function, eval, include)
Feb
14
comment How to determine if someone is scanning my server?
One trick not mentioned here is to leave some well known ports open (or redirected) to a tcp wrappers handler - although this isn't going to help if you're running a webserver and the scanner is only targetting a single service which is already in use on the machine.