1,357 reputation
11538
bio website
location Minsk, Belarus
age 23
visits member for 2 years, 6 months
seen Apr 11 at 15:59

Feb
14
awarded  Critic
Feb
14
asked Is “untrusted code” reported by DOM Snitch a vulnerability?
Feb
7
accepted Should I prevent user from operating with site during some first seconds?
Feb
7
comment Which SSL/TLS ciphers can be considered secure?
Why haven't you said about CBC ciphers and BEAST?
Feb
6
accepted Should user be allowed to save password in browser?
Feb
4
revised Should I prevent user from operating with site during some first seconds?
attacker.com and victim.com are a standard way of naming such addresses
Feb
3
revised What is the most reliable way to transfer emails without specific recipient support?
added 132 characters in body
Feb
3
asked What is the most reliable way to transfer emails without specific recipient support?
Feb
3
awarded  Citizen Patrol
Feb
2
asked Should user be allowed to save password in browser?
Dec
22
revised Should I prevent user from operating with site during some first seconds?
added 106 characters in body; edited title
Dec
22
accepted Should user input be validated for it's length?
Dec
22
asked Should I prevent user from operating with site during some first seconds?
Dec
16
asked Should user input be validated for it's length?
Dec
12
comment How should web app developers defend against JSON hijacking?
What browsers allow redefining of built in functions that may be used by attacker to hijack JSON if only 1 item is done?
Dec
9
comment How should web app developers defend against JSON hijacking?
Is doing only 1) from this list a good protection against JSON hijacking? I read that it's possible to override behaviour of Object but I can't reproduce it in modern browsers. Is it reproducible?
Nov
1
comment Preventing information disclosure from browser back button/history?
Regarding #4: what's bad with it? Why application shouldn't accept POST requests for urls that are normally operated with POST requests. I asked this question previously but it seems that there is no real attack scenario
Oct
25
comment What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft
I think that question was about current status of a "more workable solution can be achieved by including HSTS data inside DNS records, and accessing them securely via DNSSEC" (from wikipedia), not about current status of HSTS itself
Oct
25
comment What key exchange mechanism should be used in TLS?
Could you sort elliptic-curve key exchange algoritms in terms of their relative security and give details about their browser support? Unfortunately I'm not able to find details about it.
Oct
24
revised Should I prevent sending of GET requests for urls that are normally operated with POST request?
deleted 13 characters in body