Reputation
501
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 9
Newest
 Nice Answer
Impact
~66k people reached

Dec
1
comment JavaScript encryption for websites delivered via IPFS
My answer is assuming that the user encrypts stuff for himself and does not ever intend to share his data but rather keep the encryption key to himself. Maybe you can clarify that in your question?
Dec
1
answered JavaScript encryption for websites delivered via IPFS
Sep
8
awarded  Nice Answer
Mar
24
comment Secure a string in PHP
What you want may be an HMAC with a timestamp?
Mar
2
comment Preventing XXE Injection
@wireghoul While this is a perfectly fine answer, the idea of StackExchange is to provide concise & complete answers: The etiquette suggests, that a definitive answer is within your post. Use links just for reference and source attribution. Anyway, here's an upvote. :)
Mar
2
comment Do WebGoat style XSS attacks still work?
I'd argue that this simple XSS case is still a prevalent issue. The XSS protections are just a safety-belt, not a real security control – says also a Google Security Engineer.
Feb
27
comment What is Net-Worm.PHP.Mongiko trying to do?
Thanks, I updated my answer. Feel free to edit right away, in the future!
Feb
26
revised What is Net-Worm.PHP.Mongiko trying to do?
added 164 characters in body
Feb
25
comment What is Net-Worm.PHP.Mongiko trying to do?
For the aspiring reverse engineers: A suspicious removal tool (that is likely malware) can be found on hXXp://rkcheck.org/index.html (this link is intentionally broken. Do not install their software.)
Feb
25
answered What is Net-Worm.PHP.Mongiko trying to do?
Feb
20
comment Is it secure to have source code for website public?
Hint: Some companies pays you money if you find security vulnerabilities in their software. For Mozilla, this includes websites and services. Even they make their source code public on GitHub! See github.com/mozilla ;)
Nov
1
answered CSP Reports: Ignoring Client Malware
Sep
24
awarded  Autobiographer
Sep
8
comment How to stop other websites from sending cross domain AJAX requests?
A canonical resource about this is OWASP's wiki page about CORS: owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
Mar
21
awarded  Yearling
Mar
21
answered Secure a string in PHP
Mar
21
comment Is a web application firewall necessary if the application is secure?
I'd like to add that "secure" may be easily contested. It might make sense to get the WAF to protect against generic attacks that are hard to defend against on the application layer (e.g., unwanted spiders)
Jan
10
answered Regarding Cross-Site Scripting attacks
Jan
10
answered Anomaly detection in HTTP REFERER
Jan
10
answered Getting detailed information about an infected website