918 reputation
616
bio website php100.wordpress.com
location San Jose, CA
age 40
visits member for 3 years, 10 months
seen Aug 28 at 20:49
Programmer (Unix, Windows, C, C++, PHP, etc.)

Aug
11
comment What is your way to create good passwords that can actually be remembered?
@Paulo That provided there are really sites that have humans ponder over each password entered there (out of hundreds of people signing up every day, probably) and guess the algorithm which is being used (and these humans are smart enough to guess it by just one instance). I think it's moderately safe to bet that chances of this happening are low. And if the site proves malicious the harm of giving them my email is probably worse - I get tons of trash from some sites that I signed up, found they are worthless and too lazy to find out how to delete my account.
Aug
7
awarded  Nice Question
Aug
2
accepted security implications of NULL dereference
Jul
28
awarded  Editor
Jul
28
revised security implications of NULL dereference
added 419 characters in body
Jul
28
asked security implications of NULL dereference
Jul
25
accepted SANS training - worth it?
Jul
24
comment SANS training - worth it?
@AviD As I said, I do not plan to specialize on infosec. I already have a job. I am hoping to upgrade and update my knowledge of security matters as it pertains to creating secure web applications. I am however not looking for certs and not looking for basic "what is XSS" type of courses, but rather in-depth stuff that would tell me something I didn't know before - new techniques, new threats, etc. So my question is are these ones worth it for expanding my knowledge - and maybe if not, what one would recommend instead.
Jul
23
asked SANS training - worth it?
Jul
5
awarded  Nice Question
Jun
4
awarded  Citizen Patrol
Apr
19
comment MIME sniffing protection
Thanks, this paper looks very useful.
Apr
19
accepted MIME sniffing protection
Apr
17
asked MIME sniffing protection
Feb
18
comment What is your way to create good passwords that can actually be remembered?
I tried this method for a while, but in 4-5 years you completely forget which line from which song you used for which place, and with special characters you may as well randomly generate it - you have no chance of remembering it. At least I don't. That's why I abandoned this method.
Jan
23
comment Is SSL key generation client-side, server-side, or both?
DH can be used as key exchange protocol, yes. Usually DH is used when there's no certificates in play and RSA if there are certificates. See httpd.apache.org/docs/2.0/ssl/ssl_intro.html
Jan
23
answered Is SSL key generation client-side, server-side, or both?
Jan
5
accepted Is anybody using client browser certificates?
Jan
3
comment Is anybody using client browser certificates?
Almost nobody's using 2-factor auth either, but there at least I see the reason - distributing physical tokens has costs. Certs cost nothing though.
Jan
3
awarded  Scholar