253 reputation
318
bio website michaelsanford.com
location
age
visits member for 3 years, 11 months
seen Nov 22 at 12:14

Jan
18
comment What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)
It's much simpler than that: pagination sucks. Also, see UX.se ux.stackexchange.com/search?q=infinite+scroll
Jan
17
comment Tor - chain of connected nodes?
Related watching, from Dec 2011: How governments have tried to block Tor. (There's some PG cursing in the video.)
Jan
14
comment Clarification on an email about a security breach
@Hammo Re-reading this 6 months later, after a coffee, I agree.
Oct
18
comment How to exploit DRUPAL-SA-CORE-2012-003
Your .htaccess directive seems odd: why not use deny from all (with an optional allow from your.developmen.ip.address), rather than order allow,deny? More information: kavoir.com/2009/01/…
Sep
24
comment Why does Microsoft limit password length?
The first sentence is the answer I was looking for! Thanks. (I didn't consider my question a duplicate because I wasn't asking a theoretical question about a planned system, as the linked one does, but a practical question about one that already exists.)
Sep
18
comment How do I protect my Gmail account when accessing it via an Android smartphone?
@Ramhound I think the point is that if the phone were unlocked, the attacker could get access to the applications which are already authorized on that phone, and then use the fact that he has access to GMail to reset passwords on other sites.
Aug
28
comment Does GateKeeper on OS X 10.8 offer any reasonable protection from exploits?
Social engineering defeats a lot of security. Not to be ignored, especially in this context, is the sheer appeal of the app: I've been shocked at how many apps in the Android market want my "Location: fine (GPS)" that have no business requesting it. I have the feeling that 99% of those who encounter that permission-request warning just install it anyway because they want to use the app.
Aug
27
comment What is a cryptographic puzzle?
See Bitcoin confirmations for another interesting implementation: en.wikipedia.org/wiki/Bitcoin#Confirmations @bjarkef
Aug
1
comment Why do attackers bother (trivially) obfuscating their source code?
Ah, so I was on the right track! Thanks, Polynomial.
Jul
25
comment password complexity policy for non “English” passwords
@george_h The passwords are really in English, and not just latinized Arabic words?
Jul
25
comment Should IP addresses be validated to prevent SQL Injection?
+1 Good answer.
Jul
25
comment Should IP addresses be validated to prevent SQL Injection?
Only variables prefixed with HTTP_ are pulled from the HTTP header (hence the prefix): stackoverflow.com/questions/6474783/…
Jun
28
comment What do the various browser “private modes” do?
@curiousguy Indeed, the key offering of Tor is its anonymizing proxy, which hides your identity from the server, which private browsing doesn't even attempt to do.
Jun
27
comment What do the various browser “private modes” do?
+1, especially with the caveat. "Private browsing" is not the same thing as using Tor (torproject.org) or other anonymizing proxy servers, it simply (1) doesn't save history and (2) doesn't save cache to disk (but Chrome, for example, does cache files to memory).
May
10
comment header injection + codeigniter
+1 And @chowwy, good community spirit!
Mar
24
comment Setting DHCP lease time to very small time increases security?
@nealmcb, I would wager that this is a question from a university assignment.
Feb
26
comment Security impact of using a public password for free WiFi
Too bad we can only +1; this answer deserves +10!