912 reputation
611
bio website
location
age
visits member for 3 years, 3 months
seen 19 hours ago

May
6
comment Is it possible to bypass HTML character reference encoding to inject SQL in this context?
@Mico, how can you tell that replacement is happening at the serverside? Do you have access to the server?
Mar
30
comment Why don't popular web services mask the CVV?
@Gray actually "why doesn't google do it" has probably a factual answer (but we do not know it) and "should we be masking CVVs?" is opinion based.
Mar
22
comment Why is the truncate function for HMAC one time passwords so complicated?
Duplicate of crypto.stackexchange.com/questions/5249/…
Mar
3
awarded  Popular Question
Feb
21
answered How to be sure laptop's trusted certificates are safe
Jan
29
awarded  Yearling
Jan
10
answered RC4 support in SSL configuration
Nov
23
comment Access token vs. UserID + access token
When you do so you have effectively introduced an userID. You just happen to store it as the last 6 bytes of your expanded token.
Nov
23
answered Access token vs. UserID + access token
Oct
2
awarded  Good Question
Sep
20
awarded  Notable Question
Aug
24
comment someone is trying to SQL injection me.. what are they trying to do?
char(38,126,33) is just a way to write &~! without using quotes. The SQL select three innocent but uncommon characters from the database. The exploiter will watch if those three characters end up in the resulting HTML page and know there is a vulnerability.
Aug
24
comment someone is trying to SQL injection me.. what are they trying to do?
Funny, when you search Google for char(38,126,33) you will find many more attempts. I think in itself this attempt is harmless, it is only used to test whether a SQL injection is possible. Only if it is, more exploit attempts will follow.
Mar
8
answered How is a “commonly used password” determined?
Feb
10
awarded  Popular Question
Jan
29
awarded  Yearling
Sep
23
awarded  Commentator
Sep
23
comment Storing Seed for TOTP
Resetting the seed when using Google Authenticator as TOTP provider may be easy but will be impossible when using a hardware token with the seed 'burnt in'.
Sep
21
answered Is this a good way to handle login process
Sep
14
asked Does adding two-factor authentication by OTP really make KeePass more secure