Reputation
1,004
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 9 18
Newest
 Yearling
Impact
~65k people reached

Nov
11
revised Is phpseclib a secure and reliable alternative to OpenSSL?
typo fix in title
Nov
10
suggested approved edit on Is phpseclib a secure and reliable alternative to OpenSSL?
Sep
17
comment Which is the best way to sanitize user input in PHP?
One note - htmlspecialchars() is useful only in specific HTML context - such as outside tags. E.g. if you do <img src=$var> then applying htmlspecialchars() to $var won't help you, but urlencode() might. And code may also end up inside CSS or JS where different rules apply.
Jun
18
awarded  Notable Question
Jun
13
comment Is it legal to find bugs on a website and report them to the website's owner?
BTW, I've seen instances where companies answered "we don't know what you're talking about, we're super-secure" and then quietly fixed the problem. So you may hope the good deed is still done, just you're not getting any credit for it :)
Jun
10
comment What are the implications of NSA surveillance on the average internet user?
There's actually more than two stories. E.g. story about IRS considering every mailbox public information not requiring a warrant: aclu.org/blog/technology-and-liberty-national-security/…
May
26
awarded  Popular Question
Dec
11
awarded  Yearling
Sep
26
awarded  Popular Question
Jul
30
answered “Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?
Jul
7
comment Are there vunerabilities with this authentication mechanism?
@curiousguy I think many protocols that ignore invalid data and do not cancel communication when getting some invalid data would not be susceptible o this particular problem.
Jul
6
comment Are there vunerabilities with this authentication mechanism?
Checking if request token was authorized doesn't help, because attacker could after observing step 2 disrupt communication with the client (e.g. by some kind of network attack slowing down client's network) and issue his own response with the timestamp first. If you allow only one response with this timestamp, you then allow very easy DOS attack on the protocol - I can prevent any client from logging in as long as I can send response faster than they do. If you allow many responses with the same timestamp, I can bruteforce it.
May
9
comment Hiding version - valuable or just security by obscurity?
you can, never saw that done in practice though.
May
9
comment Hiding version - valuable or just security by obscurity?
but if you have a set of exploits, why wouldn't you just launch all of them? It'll take you probably 5-10 seconds for all (99% of exploits take one request to execute), why rely on version and limit your potential list? Are there any data that point attackers really rely on versions in the field? I regularly have ancient exploits tried on my servers, but this of course is anecdotal.
May
8
comment Hiding version - valuable or just security by obscurity?
As I said, one of the reasons to expose it may be so you could have automated tools to inventory your systems and alert you about old versions being left behind. So there are reasons :) What I'm asking is why everybody places this on the vulnerabilities lists together with real issues (like XSS, XSRF, etc.) as if it by itself could have any influence on your security.
May
8
comment Hiding version - valuable or just security by obscurity?
You can easily recognize app powered by Wordpress without needing any "powered by" - Wordpress has very specific structure of URLs, probably indexed by Google: wp-content, wp-includes, wp-login, etc.
May
7
asked Hiding version - valuable or just security by obscurity?
Mar
20
comment Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
I think that greatly depends on the sentences that the ones that were recently caught get. It's one thing to wreak havoc knowing that nobody will ever get to you, another knowing the end of the road is 15 years in federal prison...
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@HughAllen consider also that there were cases of US government taking over .com domains of entities outside US which violated US laws. So having .com site and committing a felony in the US is usually not a very smart move for an entity whose business is entirely web-based.
Jan
17
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
@TomLeek sorry, I don't see how that makes sense - you can run bare SQL in any language that supports direct DB query (which is all of them that support connecting to DB). Security practices are well-known and are the same for PHP as for any other language. There's no such thing as "PHP record" because each software is written in a different way by different people. It's like saying electricity is bad because all computers that were hacked used electricity. It's just FUD stemming from repeating third-party misinformation without bothering to check the actual facts.