772 reputation
510
bio website
location
age
visits member for 2 years, 8 months
seen 9 hours ago

Oct
2
awarded  Good Question
Sep
20
awarded  Notable Question
Aug
24
comment someone is trying to SQL injection me.. what are they trying to do?
char(38,126,33) is just a way to write &~! without using quotes. The SQL select three innocent but uncommon characters from the database. The exploiter will watch if those three characters end up in the resulting HTML page and know there is a vulnerability.
Aug
24
comment someone is trying to SQL injection me.. what are they trying to do?
Funny, when you search Google for char(38,126,33) you will find many more attempts. I think in itself this attempt is harmless, it is only used to test whether a SQL injection is possible. Only if it is, more exploit attempts will follow.
Mar
8
answered How is a “commonly used password” determined?
Feb
10
awarded  Popular Question
Jan
29
awarded  Yearling
Sep
23
awarded  Commentator
Sep
23
comment Storing Seed for TOTP
Resetting the seed when using Google Authenticator as TOTP provider may be easy but will be impossible when using a hardware token with the seed 'burnt in'.
Sep
21
answered Is this a good way to handle login process
Sep
14
asked Does adding two-factor authentication by OTP really make KeePass more secure
Sep
8
comment Where's the virus in this web site?
Some smart viruses and malware will detect they are being run inside a virtual environment and hide their malicious intent.
Aug
29
answered how to know what hash function have been used
Aug
17
comment What are the benefits and drawbacks of emailing a user a login token/link?
There may be technical reasons why I cannot access my e-mail everywhere. Take for example my corporate e-mail address: I can only access it when I am at the office or when I set up a VPN connection with a token or a client certificate. If I registered to your site while I was at the office, I can only ever access it again when I am at the office. Also some providers do not offer web-mail. That means I need to set up a pop3 account on any computer I ever want to access your site from?
Aug
17
answered What are the benefits and drawbacks of emailing a user a login token/link?
Jul
27
answered Custom programming language, and translator that translate it to Java to make more difficult to get source
Jul
6
comment Is it dangerous “Powered by…” tag
But be careful with a version number in the banner: "Powered by Wordpress version v1.2 is much more revealing than simply the framework used. That way an attacker can easily find out if you applied the latest security patches.
Apr
2
answered Why is application crash considered insecure?
Mar
29
comment What is the “about:blank” context for browser security and privacy?
Beware when you use about:blank in an https website. The about:blank is in a different zone and some browsers will throw an annoying warning about 'mixed content'
Feb
15
comment Is this SSO design secure?
For starters, the referrer header can easily be forged, you can not rely on it for security.