ordag

Unregistered less info

756 reputation

bio	website
	location
	age
visits	member for	1 year, 5 months
	seen	Mar 14 '12 at 9:51
stats	profile views	12

	756 reputation	bio	website		visits	member for	1 year, 5 months
45 badges		location			seen	Mar 14 '12 at 9:51

summary answers questions tags badges favorites bounties reputation activity

40 Actions

suggestions reviews revisions comments badges posts accepts all

Jun 12	awarded	Good Answer
Apr 12	awarded	Good Answer
Dec 29	awarded	Yearling
Mar 13	comment	Securing dropdown boxes @SteveS What I meant with "client-side validation is always wrong" is that it is always wrong in terms of security. the other part you meant is, of course also important, UX
Mar 13	comment	Securing dropdown boxes I'd recommend to first check the type of the input data, in your case it seems you want numbers as input. So check if it's a real number, and then if that number is in the range of values you accept, so if `1` is Option A, ..., and `5` is Option E, check if the input number is between `1` one `5` (inclusive of course). This shall just be an example to show the direction. A good resource for php is the manual, and it also has a chapter for filters.
Mar 13	comment	Securing dropdown boxes You current plan is client-side input validation. Do not ever in any circumstances do client-side validation. You have to check the input in your php script, at the server side, and reject wrong and malformed data.
Mar 12	awarded	Enthusiast
Mar 11	comment	How do you visit a link without risking your computer? @Greg On Windows I'd using the present PowerShell: `(New-Object System.Net.WebClient).DownloadString("http://whatever") > whatever.txt`
Mar 11	comment	How do you visit a link without risking your computer? The site redirects you to another domain with an online drugstore. Remember, don't but these things on the internet but from your local store after consultation of your doctor.
Mar 11	comment	How do you visit a link without risking your computer? You could download the target page with wget, a self written program, telnet ;-), or something else and view/analyze it in plain text.
Mar 9	comment	Is it safe to install malware in a VM True, virt-what as an example that it is indeed possible to detect VMs. Specific behavior is just the next logical step.
Mar 9	comment	Is a mobile app more secure for mobile use than the “normal” website? The mobile web browser can of course verify the authenticity as good as a "normal" one. The problem, as stated in the linked question, is that it may not show this information or let the site hide the real result. Of course that can be dangerous, but it's no "hackable" TLS/SSL.
Mar 9	awarded	Nice Answer
Mar 8	comment	SSL with GET and POST No, the full HTTP communication is encapsulated in SSL/TLS, *if the protocol is HTTPS* for both examples!** Be aware that referenced resources (images, etc.) may be delivered insecure, depending on their uri.
Mar 8	answered	How does preventing automatic download of pictures help to protect my privacy?
Mar 7	comment	Does TOR Hidden Service Protocol provide more threat protection than a standard HTTPS session? "threat protection". what or who is your threat? from whom do you seek protection?
Mar 6	comment	When in the keys switching happens in RSA-rc4 RSA is an asymmetric key algorithm, so completely different to the symmetric key algorithm RC4, you should look up the SSL/TLS Handshake
Mar 5	comment	Secure communication between C# client and Java server, using certificates Don't do something on your own, but use preexisting implementations! It basically doesn't matter which languages you're using, SSL/TLS dosn't care, SSL from C# is exactly the same SSL as SSL from Java. You should take a look at this documentation for Java and for C#, they will cooperate.
Mar 4	comment	Issuing browser certificates to Chrome and Firefox with Microsoft CA What do you mean with "Microsoft-based CA"? Chrome uses the Windows Cert Store, so should be aware of all Microsoft Root Certs.
Mar 3	comment	A proposal for Data Transmission and Password Encryption Man-in-the-middle attack, don't ever roll out your own crypto protocol. RSA, SHA, ... all such things are nothing if the protocol is broken.