Reputation
1,019
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 9 18
Newest
 Yearling
Impact
~65k people reached

Feb
18
comment What is your way to create good passwords that can actually be remembered?
I tried this method for a while, but in 4-5 years you completely forget which line from which song you used for which place, and with special characters you may as well randomly generate it - you have no chance of remembering it. At least I don't. That's why I abandoned this method.
Jan
23
comment Is SSL key generation client-side, server-side, or both?
DH can be used as key exchange protocol, yes. Usually DH is used when there's no certificates in play and RSA if there are certificates. See httpd.apache.org/docs/2.0/ssl/ssl_intro.html
Jan
23
answered Is SSL key generation client-side, server-side, or both?
Jan
5
accepted Is anybody using client browser certificates?
Jan
3
comment Is anybody using client browser certificates?
Almost nobody's using 2-factor auth either, but there at least I see the reason - distributing physical tokens has costs. Certs cost nothing though.
Jan
3
awarded  Scholar
Jan
3
accepted Storing third-party auth info securely
Jan
3
comment Is anybody using client browser certificates?
It doesn't have to be all-powerful - you can still ask for a password, for example. You can grant access to low-security areas with password alone and to high-security ones only with cert+password. That's just one model, of course.
Jan
3
awarded  Commentator
Jan
3
comment Is anybody using client browser certificates?
I see your point, but that can be all done in the browser... The user should just download/double-click the file and that's it. Browser extensions are very complex things but were made seamless to the user, for example.
Jan
3
asked Is anybody using client browser certificates?
Jan
1
answered What is your way to create good passwords that can actually be remembered?
Dec
31
comment What is your way to create good passwords that can actually be remembered?
the problem with this method, once you forget was it "add @@ in the front, $$ in the back, shift 1 to the left and 2 down with wrap" or "add ## to the back, 12 at the front, shift 2 to the right with wrap and 1 down without wrap" you have a problem :) And sometimes you need passwords to places you last visited 4 years ago...
Dec
31
comment What prevents this exploit from working (unix SUID)?
Actually, you can set the SUID bit. You can't make it SUID to another user though, if you're not root.
Dec
31
answered Disable insecure/dangerous PHP functions
Dec
31
comment Disable insecure/dangerous PHP functions
IMHO this is an exercise in futility. If somebody gains access to your system allowing him to run arbitrary PHP code on your system, disabling functions not going to help. There are dozens on functions not listed which can be used this way. Actually, this list makes zero sense - mysql_pconnect is there but mysql_connect and mysqli_connect are not.
Dec
29
comment Why do people say that PHP is inherently insecure?
@Ams of course there are (were) vulnerabilities, as in any other software big and popular enough. This however in no way means some "inherent insecurity".
Dec
25
comment Storing third-party auth info securely
There is a good reason. This is a service that users ask for, which works with their email data. I'm not sure I can reveal the details of what is done with the data, but they are mostly irrelevant - if you are concerned that the users don't know about what is involved, or somehow getting taken advantage of - it is not so. I'm not sure why you mention spam - it has absolutely nothing to do with spam.
Dec
25
comment Whitelisting DOM elements to defeat XSS
The same way - XSS site vulnerability. Imagine site that prints title (which is in the head section) according to user input and forgets to validate... Also, it may manipulate DOM to inject stuff into head section - so you'd have to introduce DOM permissions. And what if there's some vulnerable page that doesn't have <HEAD> elements at all - like one generating JSON? I could supply my own <HEAD> and thus break the protection.
Dec
25
answered GET with additional parameters leads to “code injection” in html displayed