User Andrey Botalov - IT Security Stack Exchange

bio	website
	location	Minsk, Belarus
	age	22
visits	member for	1 year, 7 months
	seen	9 hours ago
stats	profile views	120

	1,132 reputation	bio	website		visits	member for	1 year, 7 months
1031 badges		location	Minsk, Belarus		seen	9 hours ago

9

16

votes

2

answers

3

kviews

Minimum requrements for storing last 4 digits of credit card number?

sep 11 at 10:33 Andrey Botalov 1,132

3

10

votes

1

answer

367

views

How can I embed iframe securely without restricting its functionality?

web-application web-browser javascript same-origin-policy html

jan 16 at 6:03 noob1992 6

2

10

votes

1

answer

4

kviews

What key exchange mechanism should be used in TLS?

web-application encryption ssl key-exchange

oct 24 '11 at 18:05 Andrey Botalov 1,132

9

votes

2

answers

179

views

Should I prevent user from operating with site during some first seconds?

appsec attack-prevention

feb 4 '12 at 22:17 bobince 3,075

7

votes

2

answers

2

kviews

ssltest: Chain issues - Contains anchor

web-application ssl certificates

nov 27 at 12:03 Thomas Pornin 82.5k

7

votes

5

answers

387

views

How to prevent pay per show/click abuse?

web-application defense fraud algorithm

oct 2 at 18:21 ddyer 599

7

votes

1

answer

489

views

How to make SQL injection in PostgreSQL's tsquery?

web-application attacks databases sql-injection

aug 15 at 16:27 Rory McCune 14.4k

7

votes

2

answers

311

views

Should user be allowed to save password in browser?

appsec web-application passwords authentication web-browser

feb 2 '12 at 16:57 Gilles 10.1k

6

votes

2

answers

812

views

Is it possible to do HTTP header injection if CR/LF are stripped?

web-application attacks http injection response-spliting

jan 6 at 16:05 makerofthings7 12.6k

1

6

votes

7

answers

533

views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

web-application appsec attack-prevention http csrf

jul 19 at 20:44 Andrey Botalov 1,132

5

votes

1

answer

415

views

When and Why does Chrome display malware detection warning?

web-browser malware chrome

oct 18 at 16:13 Andrey Botalov 1,132

5

votes

2

answers

4

kviews

Is BEAST really fixed in all modern browsers?

ssl web-browser beast

oct 4 at 22:46 Andrey Botalov 1,132

1

5

votes

3

answers

474

views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

legal compliance pci-dss

sep 11 at 19:06 HMark 51

5

votes

3

answers

444

views

Is there a reason to protect SIM with PIN?

authentication mobile

aug 20 at 0:13 Gilles 10.1k

2

5

votes

3

answers

1

kviews

Is it possible to inject HTML into image to provoke XSS?

web-application exploit xss file-upload

jul 7 at 22:04 Mike Samuel 2,547

5

votes

3

answers

205

views

Is “untrusted code” reported by DOM Snitch a vulnerability?

web-browser vulnerability-scanners

feb 21 '12 at 8:29 Andrey Botalov 1,132

1

5

votes

3

answers

206

views

Should user input be validated for it's length?

appsec web-application attacks

dec 18 '11 at 19:51 D.W. 44.8k

2

4

votes

3

answers

1

kviews

Is client side encryption really better than server side?

encryption web-application trust usability

aug 5 at 15:44 Andrey Botalov 1,132

4

votes

3

answers

293

views

Is there a security risk in existence of those HTTP headers in responses?

web-application appsec http

jul 20 at 21:42 Andrey Botalov 1,132

4

votes

5

answers

1

kviews

Is it trivial to bypass IP blocking?

network webserver ip-spoofing

mar 22 '12 at 13:19 Grant 243

3

votes

1

answer

70

views

Is it possible to verify identity of site that sent request to you?

web-application appsec attack-prevention

oct 3 at 18:36 Moses 674

3

votes

1

answer

109

views

Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?

web-application ssl attacks cookies same-origin-policy

sep 27 at 20:18 Thomas Pornin 82.5k

3

votes

2

answers

320

views

Is Drupal's filter_xss enough for filtering HTML?

web-application appsec attack-prevention xss

sep 10 at 18:36 Mike Samuel 2,547

1

3

votes

3

answers

1

kviews

How insecure are PHP's rand functions?

cryptography php random

aug 6 at 10:32 Andrey Botalov 1,132

1

3

votes

1

answer

157

views

Is there a way to store user files without being able to decrypt them?

cryptography encryption web-application file-encryption trust

jul 5 at 18:48 Gilles 10.1k

1

2

votes

6

answers

878

views

Efficient way for finding XSS vulnerabilities?

web-application attacks penetration-test xss

may 3 at 10:54 nikhil 1

2

votes

3

answers

137

views

How to subscribe to information about new vulnerabilities in selected products?

zero-day cve

dec 19 at 6:14 Jor-el 52

2

votes

2

answers

312

views

Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?

passwords hash key-management pgp

dec 18 at 21:38 Andrey Botalov 1,132

2

votes

1

answer

92

views

Is it safe to invoke PHP GD functions if you don't know whether file is a valid image?

web-application attacks php exploit file-upload

sep 26 at 16:05 gowenfawr 5,962

2

votes

5

answers

280

views

Can web application do anything to prevent risk from client-side malware?

web-application appsec malware client-side keyloggers

jul 30 at 14:23 George Bailey 1,687

Andrey Botalov

48 Questions