Reputation
204,922
Next tag badge:
207/100 score
19/20 answers
Badges
34 458 676
Newest
 Good Answer
Impact
~9.1m people reached

Apr
24
answered How to get top management support for security projects?
Apr
24
reviewed Approve How to get top management support for security projects?
Apr
24
reviewed Approve OpenSSL Code Review
Apr
24
answered IKEv2: Why is it important “that each side sign the other side's nonce”
Apr
23
comment Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?
RAND_seed() does not replace the internal state, it adds to the entropy. Internally, the mixing is done with a hash function (or something similar). Thus, an application which does useless things (as the one you show) cannot destroy its own security that way (and that is a blessing, because applications often do stupid things when randomness is involved).
Apr
23
answered Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?
Apr
23
answered Most secure SSH server
Apr
23
reviewed Reject Should I obscure database primary keys (IDs) in application front end?
Apr
23
answered OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys
Apr
23
answered Use SSH config file with Putty
Apr
23
comment How is an HTTPS login secure when pages use HTTP?
The HTTPS will at least ensure that the password does not travel "as is" over the Internet. This is in no way "complete" as far as security is concerned, but allowing a password to travel unprotected would look really bad. Remember that Ebay's business, ultimately, is not about protecting the user; it is more about protecting Ebay.
Apr
23
answered Which hashing algorithm is ideal for use on the web?
Apr
23
comment How is an HTTPS login secure when pages use HTTP?
Well, technically, the non-SSL HTTP is not secure -- it is vulnerable to MitM attacks. I am just explaining the reasons why Ebay may tolerate this vulnerability.
Apr
22
awarded  Nice Answer
Apr
22
answered How can I add a layer of security to cleartext passwords and SSL?
Apr
22
answered Is there a maximum allowed key size in the USA?
Apr
22
reviewed Reject Why OpenSSL can't use /dev/random directly?
Apr
22
reviewed Approve Can “cat-ing” a file be a potential security risk?
Apr
22
reviewed Reject How can I create a password that says “SALT ME!” when hashed?
Apr
22
revised How do I securely deal with SSL certificate validation failure when the client date is incorrect?
added 339 characters in body