Reputation
2,735
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
10 18
Newest
 Enlightened
Impact
~193k people reached

Feb
10
comment Is it safe to binary-deserialize user-provided data?
Hmm OK, but specifically this is a class that a malicious person might write, I think the most reduced version of a malicious payload here might be best to illustrate the problem. I think that the method doesn't get used at all in this example of an exploit but its presence made me think I'd misunderstood.
Feb
10
comment Is it safe to binary-deserialize user-provided data?
What is the purpose of the GetStream() method?
Jan
28
comment Does prefetching/preloading in web browsers pose a security risk?
I think I mislead you by mentioning the CSS parsing vulnerability in IE. I believe HTML is still parsed by the prefetch engine, though, in order to obtain what other static content should be downloaded.
Jan
28
answered Does prefetching/preloading in web browsers pose a security risk?
Jan
18
comment Is it dangerous to publicly share a scopeless token?
@IonicăBizău Yes, I think that is session fixation you're describing. See if this OWASP description matches what you think: owasp.org/index.php/Session_fixation
Jan
18
answered Is it dangerous to publicly share a scopeless token?
Dec
16
comment E-mail already in use exploit
@AdamMarshall why is it an issue to find out (maliciously, up to x attempts) if an e-mail address is registered to a service? GdD's answer requires a user who already has an account but has forgotten this to complete every single form field correctly before they are told. The actual pitfalls of enabling a handful of e-mails to be enumerated before rate-limiting are very small.
Dec
14
awarded  Enlightened
Dec
14
awarded  Nice Answer
Oct
24
comment Where do you store your personal private GPG key?
@naxa the point is not transmitting your private key over the Internet. If it's encrypted then that's OK, but otherwise you want to use Javascript because that means only your computer sees the data. I will try to find a new solution and update my answer.
Oct
22
comment Does this concept attack work to harvest credentials and 2FA using offline fake site?
HSTS will prevent this on facebook.com.
Jul
24
awarded  Citizen Patrol
Jul
21
awarded  Caucus
Jul
7
awarded  Enlightened
Jul
7
awarded  Nice Answer
Feb
13
awarded  Yearling
Jan
19
comment How to generate cryptographically strong pseudorandom data very rapidly?
@supercat I don't think it's necessarily an advantage that TRNGs don't have an internal state it needs to keep secret - mainly because TRNGs use environmental data to produce random output, so if you have physical access/control over the environment you can affect the output in some way (just as you might predict the output if you could get that seed data).
Sep
24
awarded  Autobiographer
Jul
17
comment How can I prevent my kids from bypassing my computer restrictions?
This is definitely a parenting question. Find a creative way of encouraging this and you could be raising the next Bill Gates :-) (or at least a talented IT professional)
Jul
1
comment Where do you store your personal private GPG key?
@johannestaas It's straightforward to encrypt the keys before backing them up although I'd prefer not to rely on remembering the pass-phrase. A backup in a physically secure location trumps encryption, IMO. You could use an open-source QR reader on an off-line device and then destroy all the data on it before putting it on-line again.