1,457 reputation
11640
bio website
location Minsk, Belarus
age 23
visits member for 2 years, 9 months
seen Jul 23 at 20:38

Feb
19
accepted Is “untrusted code” reported by DOM Snitch a vulnerability?
Feb
16
comment Is “untrusted code” reported by DOM Snitch a vulnerability?
Actually, this extension is DOM Snitch yourself. Does it mean that DOM Snitch generates vulnerability that tells only that it parses page. Why DOM Snitch generates this vulnerability?
Feb
16
awarded  Promoter
Feb
14
awarded  Critic
Feb
14
asked Is “untrusted code” reported by DOM Snitch a vulnerability?
Feb
7
accepted Should I prevent user from operating with site during some first seconds?
Feb
7
comment Which SSL/TLS ciphers can be considered secure?
Why haven't you said about CBC ciphers and BEAST?
Feb
6
accepted Should user be allowed to save password in browser?
Feb
4
revised Should I prevent user from operating with site during some first seconds?
attacker.com and victim.com are a standard way of naming such addresses
Feb
3
revised What is the most reliable way to transfer emails without specific recipient support?
added 132 characters in body
Feb
3
asked What is the most reliable way to transfer emails without specific recipient support?
Feb
3
awarded  Citizen Patrol
Feb
2
asked Should user be allowed to save password in browser?
Dec
22
revised Should I prevent user from operating with site during some first seconds?
added 106 characters in body; edited title
Dec
22
accepted Should user input be validated for it's length?
Dec
22
asked Should I prevent user from operating with site during some first seconds?
Dec
16
asked Should user input be validated for it's length?
Dec
12
comment How should web app developers defend against JSON hijacking?
What browsers allow redefining of built in functions that may be used by attacker to hijack JSON if only 1 item is done?
Dec
9
comment How should web app developers defend against JSON hijacking?
Is doing only 1) from this list a good protection against JSON hijacking? I read that it's possible to override behaviour of Object but I can't reproduce it in modern browsers. Is it reproducible?
Nov
1
comment Preventing information disclosure from browser back button/history?
Regarding #4: what's bad with it? Why application shouldn't accept POST requests for urls that are normally operated with POST requests. I asked this question previously but it seems that there is no real attack scenario