560 reputation
214
bio website
location
age
visits member for 2 years, 8 months
seen Oct 16 at 2:55

Oct
2
comment version support policy for BYOD devices
2 Wifi spots: 1 for leasure/personnal. The other for work. For the first, where the Android/iOS devices come in I think you just should let it go. The other one, it's another issue entirely to me.
Oct
2
comment Why injecting a php tag with XSS dosn't work?
XSS = interpreted on client side. Clients don't deal/understand PHP. To inject dynamic PHP would be possible in very very very specific contexts and XSS are completely unrelated to this
Jul
9
comment Is “Why Should You Avoid AES In MySQL?” true?
This ^. Although I think that there are a lot of issues with encryption as it might open the gate to amplification attacks. Thus using a secure layer as SSL might do it... But again, SSL cannot be really trusted. Anyhow, a captured encrypted password or a captured password is about as dangerous if you can just replay it
Jun
30
comment Is CSRF possible if I don't even use cookies?
This is the correct way to do it, check how django does it: docs.djangoproject.com/en/dev/ref/contrib/csrf. It's basically a randomly generated and unique CSRF token that's on the page you visit. If the server doesn't receive it then it will not process the request at all.
Jun
30
awarded  Citizen Patrol
Apr
28
comment Localhost WebSocket defense
Can't edit anymore, but I obviously meant EC not EC2. As in the dual elliptic curve algorithm that is compromised (or actually broken by design). Which is funny since the NSA recommends (nsa.gov/business/programs/elliptic_curve.shtml) using it. While there are no proof they got the magic numbers needed to break the algorithm, but they do encourage its use even though there's a "backdoor" built-in.
Apr
28
comment Why does a business need to secure its email system?
How about "What are the different email securing strategies available for businesses?", it should be pretty obvious that email needs securing, I hope that's not the whole point of your research
Apr
28
comment Why does a business need to secure its email system?
What's the research about specifically? We can give you better answers if you give us more background and tell us what exactly you are researching
Apr
28
comment Why does a business need to secure its email system?
IMHO it's obviously homework. For the sake of argument let's remind people that securing an email system is not subject to debate. Also, notice OP's nickname.
Apr
28
answered Why does a business need to secure its email system?
Feb
27
comment Yahoo Account hacked, changed pw, spam still going out elsewhere?
Sometimes emails can take a while to be rejected. Just wait, if it keeps happening you should investigate the IP and headers to see if they match Yahoo SMTP settings (send an email to a fake address and wait for the rejected reply to compare). Worst scenario he has a session open (cookie hax) and will use it until it expires (in an automated fashion ofc). Best case, no SPF for yahoo and he sends the emails on your behalf from somewhere else, to check this, edit your Name (From: "Rob TheReal Lastname") and check if it appears in future rejected reports
Feb
5
awarded  Yearling
Jan
17
awarded  Popular Question
Jan
13
comment Localhost WebSocket defense
@Gracchus: It could. In IT security you should always assume the worst case scenario, which is basically why we implement strong solutions using the Plan, Do, Check method. If malicious code runs on a virtual machine with the least privileges it could still break out of the VM and get control of your host for instance (seen it the wild). Against cryptography there are some attacks, it's important to know which algorithm is broken and which is not, in the case of SSL, check out SSL VS TLS and their different versions/vulnerabilities. And stay away from EC2.
Oct
25
revised SSL fingerprint inconsistency: what does it mean?
added 2 characters in body
Jun
26
comment Why use OpenID Connect instead of plain OAuth?
@Ralf: As I see it, you can build apps with oauth and authorize sharing or not of specific resources linked to the user account. Using openid connect, it is made easier, the provider doesn't have to implement its own layer above oauth to handle it and clients have a standard way to access data.
Jun
21
comment Why use OpenID Connect instead of plain OAuth?
Alright, I didn't know about "OpenID Connect", I understood it as "OpenID" + "Connect". I'm sure you've already checked this: softwareforallseasons.blogspot.fr/2011/10/… + I suggest you edit your question so that it reads OAuth 2.0 instead of just OAuth.
Jun
21
comment Why use OpenID Connect instead of plain OAuth?
It's more than an authentication mechanism, OAuth will enable your application to retrieve shared contents and ask for the permission to do so. For example: facebook/gmail apps, you click agree to share your contacts and let the app write on your wall. The app then gets a token that gives it the permission to do so. If you are doing only authentication and will not do more, you could stick to openid. Note that OpenID is not that friendly compared to OAuth. I would use openid for geek/techie things and oauth for social apps.
May
20
awarded  Nice Question
Mar
21
comment Is it possible to execute a php script in an image file?
How do you display the image? The extension .gif at least reduces the possibility of code execution. If you use require() and not standard HTML then it's dangerous, else David Mah is right.