Reputation
642
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 11
Impact
~4k people reached

Apr
10
comment Alternatives to HTML's deprecated <keygen> for client certs?
Well your solution also uses the WebCrypto API. The question was about official alternatives for keygen and the W3C docs mention WebCrypto for this purpose. How it is implemented is another thing.
Apr
10
comment Alternatives to HTML's deprecated <keygen> for client certs?
Do you mean WebCrypto? This is the new official API for browser implementations.
Feb
11
awarded  Popular Question
Jan
29
comment What does an OpenPGP signature consist of?
here is also a good graphic about the structure: senderek.ie/research/security/key-experiments.html
Jan
19
comment Strange access in apache's access.log
Most bad bots check every website for WordPress or another CMS and try exploits without knowing if there is this CMS installed. Just dumb bots, nothing to worry about. Also the bot accessed an image which does not exist, so far this request is harmless.
Jan
17
comment Is there a risk that file shredders and free space wipers steal our confidential data?
like @Geir wrote Eraser is opensource so you can inspect the sourcecode and build it yourself.
Jan
16
comment Is there a risk that file shredders and free space wipers steal our confidential data?
I did not see any network activity by them when I deleted files. But there are also other alternatives like Eraser. Do not forget to erase cluster this and entries in the MFT which you can do with Windows commandline tools. CCleaner deletes files but not the entries from the MFT so the filenames are still recoverable. You can see this with Recuva.
Jan
15
comment Unauthorized access to a page - when or if you should return 401 HTTP status code
"However if you're depending on an attacker not knowing about a resource to keep it safe, you should probably improve the defenses around it instead." Right, security by obscurity was never good. You should protect your website / app as good as possible and use a webapplication firewall and other tools to block malicious and unwanted requests.
Jan
15
comment Unauthorized access to a page - when or if you should return 401 HTTP status code
usually I just use 403, this is the same error code blocked clients get (deny rules). 401 is more interesting for attackers, you are right.
Jan
15
comment Detecting Malcode in Excel and Word Documents
Do you mean something like OfficeMalScanner? Macros only work in Microsoft Office if enabled.
Jan
15
comment Unauthorized access to a page - when or if you should return 401 HTTP status code
I think you mean 403 access forbidden. 401 is for failed basicauth logins and other login related things (API).
Jan
11
comment Unusual potential vulnerability scan results in Apache logs
Does not look like an exploit. Also the requests are the same, the first is just the percent-encoded version at the end. If they result in a 403 they generally fail.
Jan
1
comment Single button click mobile direct carrier billing fraud
Right, this technique is called WAP billing.
Jan
1
comment Malicious email attachments analysis
But keep in mind that many malware samples have evasion solutions for VMs.
Jan
1
comment Help to identify this type encoding/encryption?
But can be cracked.
Jan
1
comment Chrome: Watch for modified https-certificates
I just know about this but the IE and Chrome versions are currently WIP: checkmyhttps.net/index.php
Dec
31
comment What are the problems with uploading client-side encrypted keys to keybase.io?
Private keys should always be kept private and never shared.
Dec
28
comment Are there security advantages gained from forcing a website to be available from just one tab at a time?
What if you create a second session in a new window, not tab?
Dec
28
comment All Devices on Network Being Redirected to Malware Download
how are the family devices connected to each other? Are they using the same Google account or a specific browser? Did you try to access from a different wifi?
Dec
26
comment Amateur society - What file type to use in email?
no, you can prevent email spoofimg with DKIM, DNSSEC and SPF. Also PDF files can contain malware.