331 reputation
17
bio website
location
age
visits member for 2 years, 7 months
seen 7 hours ago

Jul
9
comment Why is faking SSL certificate difficult?
@gman I believe you need to have the original private key of the CA, in order to achieve that. Keep in mind, the public CA key is stored into the user's browser and it's used to validate the actual certificate of the site. In other words, it would be almost impossible to do that. You'd have a better chance to hack the user's browser and import your own self-signed CA. :)
Feb
8
comment Are all SSL Certificates equal?
This law battle is an absolute waste of time. What difference does it make where he copied it from? This information is general and you will find pretty much a similar explanation on any other site. Claiming "copyright" over it is to put it mildly stupid. It's like saying the word "banana" is a copyrighted word and we can't use it anymore.
Jun
19
comment When changing a password, does it have to be completely different?
If I knew that your old password was password I would most definitely start with a brute-force attempt starting with your old password and continuing with all it's possible variations. So, changing your password to something completely different is what the OP (and any other user) should do in case he's been asked to, or he simply changes his password for security reasons.
Feb
18
awarded  Commentator
Feb
18
comment How to not reveal that you are using PHP?
In addition to both of you, if you're using apache, it's best practice to set ServerTokens ProductOnly
Feb
18
awarded  Critic
Feb
17
awarded  Yearling
Sep
8
revised Protecting against DOS attacks
deleted 1 characters in body
Aug
19
awarded  Caucus
Apr
12
comment What security measures to have before openly allowing security researchers to hack your site
Your invitation may be accepted as a challenge or provocation. This can trigger more hackers than usual. And if that happens you may end up hacked by many different hackers at the same time. Which will become really hard for your security team to monitor. The other major problem is that you can't rely on hackers willingness to submit real reports or to report at all. :)
Apr
3
comment What steps should one take to provide “reasonable” levels of privacy from a government?
Nice, accurate and strictly to the point answer. +1 :)
Apr
3
answered What security measures to have before openly allowing security researchers to hack your site
Mar
10
awarded  Nice Answer
Mar
2
comment Protecting against DOS attacks
@AviD many php developers use the data they receive via POST/GET "AS IS". They don't do any additional checks over the data they receive. For instance: localhost/user.php?userId=10 . Many developers think "userId" will always be an integer. And that's where someone may try sql injection. In this case it's mandatory you use this approach. The solution eliminates sql injection for the particular example.
Mar
2
comment Protecting against DOS attacks
@AviD sql injection depends on the code style the programmer is using. If he's concerned, he'll always do additional "just in case" actions over the data he receives.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
What I meant to say is the API may have it's own encryption going on inside the code. Anyway sending sensitive information (like username & password) over http is not best practice. Of course you can do it but this opens up a big whole in the security.
Feb
25
comment Why does Safari seem to be accepting an HTTPS connection every other browser rejects?
Did you check if Safari's settings don't automatically accept untrusted ssl certificates?
Feb
25
comment Explanation of SSL handshake with certificate
@RoyiNamir probably this sslshopper.com/article-most-common-openssl-commands.html will help you. Scroll down to "Checking Using OpenSSL" to see how to check a certificate's content.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
I haven't used Posterous but probably they have at least some kind of encryption going on in the api while the client/server communicates. I don't think they'd leave it just plain http. If they did - they're open to a potential attack. If you go to their site though you'll see it instantly redirects to the https. So probably they have something else going on behind the scene :)
Feb
25
answered What are practical risks of http (not https) in server-to-server communications