2,309 reputation
1113
bio website
location
age
visits member for 3 years, 11 months
seen Jun 27 at 0:20

Dec
22
awarded  Yearling
May
26
awarded  Nice Question
May
8
awarded  Good Answer
Jan
18
awarded  Notable Question
Jan
13
answered Bot detecting by considering request inter-arrival time
Jan
13
comment How about preventing CSRF this way?
Use signed session cookies, include the CSRF token in the signed session cookies, and problem solved?
Dec
22
awarded  Yearling
Aug
14
awarded  Caucus
Jul
13
comment Good session practices
Firstly, is the session-id generated by a cryptgraphically-strong PRNG, and suitably long as to be unguessable and unforgeable? Secondly, it is more important for those who session data in cookies.
May
21
comment Could mint.com be more secure, and if so, how?
Mint might be keeping the session cookie cached. Until the session expires, they won't be forced to log in because they're already in. When the session expires, they'll need to try to log in again, at which point it fails because the password you gave them is no longer valid.
May
10
comment header injection + codeigniter
None of your examples has got anything to do with protecting the server from malicious or otherwise unexpected data sent by the client (except perhaps cookie encryption, if that is indeed what you're doing).
Apr
12
revised What are the most common password salting methods?
added 67 characters in body
Feb
1
comment How are open-sourced operating systems and software kept secure?
Indeed they are. That's why they warn you that the software is not warranted at all or in any way, and that if you choose to use it you are explicitly agreeing to use it at your own risk only.
Jan
30
awarded  Necromancer
Jan
27
comment Regulations that specify password length?
I, being a regulatory body that I recognize, regulate that all passwords shall have at least one character.
Jan
24
awarded  Guru
Jan
22
answered Zero padding in HMAC
Jan
12
comment VM hypervisior that doesn't leak that it's a VM to the guest?
What is the security reason?
Jan
2
awarded  Popular Question
Dec
27
revised Explaining security vs. performace to a non-tech superior
deleted 10 characters in body