883 reputation
414
bio website php100.wordpress.com
location San Jose, CA
age 39
visits member for 3 years, 4 months
seen Apr 6 at 5:04
Programmer (Unix, Windows, C, C++, PHP, etc.)

Jul
28
revised security implications of NULL dereference
added 419 characters in body
Jul
28
asked security implications of NULL dereference
Jul
25
accepted SANS training - worth it?
Jul
24
comment SANS training - worth it?
@AviD As I said, I do not plan to specialize on infosec. I already have a job. I am hoping to upgrade and update my knowledge of security matters as it pertains to creating secure web applications. I am however not looking for certs and not looking for basic "what is XSS" type of courses, but rather in-depth stuff that would tell me something I didn't know before - new techniques, new threats, etc. So my question is are these ones worth it for expanding my knowledge - and maybe if not, what one would recommend instead.
Jul
23
asked SANS training - worth it?
Jul
5
awarded  Nice Question
Jun
4
awarded  Citizen Patrol
Apr
19
comment MIME sniffing protection
Thanks, this paper looks very useful.
Apr
19
accepted MIME sniffing protection
Apr
17
asked MIME sniffing protection
Feb
18
comment What is your way to create good passwords that can actually be remembered?
I tried this method for a while, but in 4-5 years you completely forget which line from which song you used for which place, and with special characters you may as well randomly generate it - you have no chance of remembering it. At least I don't. That's why I abandoned this method.
Jan
23
comment Is SSL key generation client-side, server-side, or both?
DH can be used as key exchange protocol, yes. Usually DH is used when there's no certificates in play and RSA if there are certificates. See httpd.apache.org/docs/2.0/ssl/ssl_intro.html
Jan
23
answered Is SSL key generation client-side, server-side, or both?
Jan
5
accepted Is anybody using client browser certificates?
Jan
3
comment Is anybody using client browser certificates?
Almost nobody's using 2-factor auth either, but there at least I see the reason - distributing physical tokens has costs. Certs cost nothing though.
Jan
3
awarded  Scholar
Jan
3
accepted Storing third-party auth info securely
Jan
3
comment Is anybody using client browser certificates?
It doesn't have to be all-powerful - you can still ask for a password, for example. You can grant access to low-security areas with password alone and to high-security ones only with cert+password. That's just one model, of course.
Jan
3
awarded  Commentator
Jan
3
comment Is anybody using client browser certificates?
I see your point, but that can be all done in the browser... The user should just download/double-click the file and that's it. Browser extensions are very complex things but were made seamless to the user, for example.