Reputation
480
Top tag
Next privilege 500 Rep.
Access review queues
Badges
3 16
Impact
~25k people reached

  • 0 posts edited
  • 0 helpful flags
  • 67 votes cast
16h
comment Where should I store OAuth2 access tokens?
The tokens are issued by the 3rd party. There is no control over how long they are valid.
2d
answered Where should I store OAuth2 access tokens?
Jan
19
awarded  Popular Question
Jan
14
comment Identifying the author(s) of a piece of malware
Don't forget about when it phones home. The IP address of the command and control server can give clues too, and possibly traced.
Dec
3
awarded  Popular Question
Dec
1
comment Corporate computers have own corporation's cert as trusted CA; should I consider all traffic compromised?
Yes, this is frequent with banks, brokerages, and high security companies. Bloomberg does this for issuing self-signed certs for internal sites and client certs for SSO. You should only use their internet for work-related purposes. If you need privacy, you should use your mobile phone's cell connection.
Nov
27
accepted How can an email from a Yahoo address be sent through Yahoo without authentication?
Nov
27
comment Best way to administer all my passwords
Keepass.info is the best. You can share the KDBX files on Dropbox.
Nov
16
comment Preventing registered users from sharing passwords
This was going to be my answer. You can use Google Authenticator or Authy, both free, or send a text message with a code to their cell phone (maybe not every teen has a smart phone). Don't limit to 2 devices - it's too big a hassle. Like you said, what if they upgrade? Clear cookies? Etc. Need customer support for that. Big expense.
Nov
6
comment My college is forcing me to install their SSL certificate. How to protect my privacy?
BTW There are also client certificates which allows a user to log in to a proxy or web service automatically without using a password, and are often confused with SSL certificates. Client certificates don't compromise privacy (except identification and authentication) for future traffic. Apache Docs
Aug
11
comment Why do people use IP address bans when IP addresses often change?
To change your IP address if your ISP uses sticky IPs, change the MAC address of your router.
Jul
8
awarded  Popular Question
Jul
1
answered Securely storing bank account details in database
Jun
30
comment Unsubscribe safely
There is no way. For me, if the email is legitimate, from a reasonably trustworthy source, or from known mailing system (MailChimp, ConstantContact), then I click unsubscribe. If it is pure spam, I block the sender. They already got through a CAPTCHA (SpamArrest), so I know they are at least not a bot.
Jun
29
comment How can you check and analyze SSL ports other than 443?
@SilverlightFox Updated
Jun
29
revised How can you check and analyze SSL ports other than 443?
comment suggested to change title
Jun
22
awarded  Yearling
Jun
21
accepted How can you check and analyze SSL ports other than 443?
Jun
21
comment How can you check and analyze SSL ports other than 443?
I can run a tool on my machine, but I thought a site would be more authoritative and configured correctly, and up-to-date, and easier to use.
Jun
21
asked Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?