17,527 reputation
34392
bio website faiumoni.de/de/start.html
location Germany, Europe
age 33
visits member for 3 years, 4 months
seen yesterday

My main focus is on security and privacy aspects in the areas of business web applications, databases and online games. I like to look further and see the whole picture.


Jun
25
revised Can home routers get infected?
edited tags; edited title
Jun
25
answered Sharing passwords and credentials between founders and employees
Jun
25
comment Sharing passwords and credentials between founders and employees
Are you suggesting to share the credentials with some online service, which already had security issues instead of an employee, known in real life and bound to a contract?
Jun
25
answered How to handle security issues of someone else's website
Jun
25
comment How does changing your password every 90 days increase security?
Furthermore "Rule 6 [change passwords often] will help only if the attacker waits weeks before exploiting the password" is wrong. It ignores the possibility that an attack may be ongoing for weeks without being noticed. Think of an attacker having access to the email account of someone from upper management. It is obvious that the benefit for the attacker may be larger if he keeps reading potential confidential emails instead of abusing the email account for SPAM or locking the owner out by changing the password.
Jun
25
comment How does changing your password every 90 days increase security?
it should be noted, that the research paper is about web-site passwords. I think this implies that the victim is the user himself or herself. In a cooperate environment the company may suffer from an attacker instead of the individual user.
Jun
24
awarded  Nice Answer
Jun
24
revised How does changing your password every 90 days increase security?
edited tags
Jun
22
awarded  Nice Answer
Jun
22
answered How does changing your password every 90 days increase security?
Jun
22
comment Should I restrict access to the username and passwords in a web app?
@AviD in Sweden a number of banks offer authentication services; at least to Swedish universities. A local bank has the advantage that it will likely comply with local privacy laws, unlike the American companies Google and Facebook (the USA have extremely weak privacy laws). The downside is that it gives profile informations of internet usage to them which might be linked to financial statistics about people. Oh, and don't forget the phishing risk on "on demand" login screens.
Jun
21
revised Is denying login after incorrect attempts ineffective?
edited title
Jun
21
revised How do DoS/DDoS work?
edited title
Jun
21
revised How do DoS/DDoS work?
added 725 characters in body
Jun
21
answered How do DoS/DDoS work?
Jun
20
revised Tips for a secure iptables config to defend from attacks. (client side!)
added ip6 rules
Jun
19
answered Tips for a secure iptables config to defend from attacks. (client side!)
Jun
19
revised Is it a security issue that Thunderbird only logically deletes emails?
edited tags
Jun
19
comment Is it a security issue that Thunderbird only logically deletes emails?
@Rory, That's why mentioned Microsoft Outlook. But still, this behaviour is not what average users expect, so it is a (minor) issue, regardless of whether this happens in an email client, database server, office document or file system.
Jun
19
revised Why are people saying that X-windows is not secure?
edited title