2,001 reputation
311
bio website plokta.com
location Canterbury, United Kingdom
age 51
visits member for 3 years, 11 months
seen 11 hours ago

18h
comment csh http shellshock on a windows 2008 server
Bash is a shell, not an interpreter. It uses an interpreted language, to be sure, but that doesn't make it an interpreter.
18h
answered Google is going to mark all HTTP traffics as insecure in 2015?
1d
comment How are zero days found?
As the joke goes, a QA engineer walks into a bar and orders a beer, a bere, two beers, -1 beers, 2,147,483,648 beers, foo beers, 0.5 of a beer, π beers, i beers.
1d
comment Things to remember while building a password manager
If you're actually planning to use this, then the best guideline is: don't. People who roll their own critical security software nearly always make mistakes that leave them vulnerable. Get yourself a reputable commercial or open-source password manager. If you're just doing it as a programming exercise to learn about writing secure software then by all means go ahead.
2d
awarded  Editor
Dec
15
answered Websites visited on a VPN network
Dec
14
comment Is biometric passport safer than old-fashioned passport
What nationality are you, and what countries are you likely to visit on your passport?
Dec
3
awarded  Nice Answer
Dec
2
answered Why must I have a “strong” password for sites like this?
Nov
25
comment Does too long a salt reduce the security of a stored password hash?
There's no point in brute-forcing a salt, because it is (or at least, should be) different for every stored password, and because it's stored with the hashed password anyway, so an attacker who has access to the password hashes will also have access to the salts.
Nov
23
comment Why do credit cards have chips, if I can purchase online without the chip being read?
@Sparkler The cardholder is already pretty well protected against card fraud, except for the often considerable nuisance of getting it straightened out. Chip and PIN is about protecting the banks and the retailers, yes. The consumer will benefit in the long run as card processing fees come down and so prices come down a bit.
Nov
22
answered Why do credit cards have chips, if I can purchase online without the chip being read?
Nov
22
answered How to Stop Email Spoofing
Oct
24
comment SSL Asymmetric encryption newbie
While agreeing that you shouldn't be collecting credit card data without a much better understanding of SSL, the missing link you're looking for is that SSL certificates have to be signed by a trusted third party whose public key is distributed with the web browser, and so never passes over the Internet where it could be intercepted. In theory, this prevents site spoofing and man-in-the-middle attacks.
Oct
6
answered PCI Compliance Check-list
Oct
5
comment What steps can be taken to secure snail mail?
@AndréDaniel I think having to scan, OCR and decrypt your snail mail would count as being inconvenienced by security, and so doesn't meet the required conditions.
Sep
15
answered What is cookie reverse engineering?
Sep
4
comment Email address book stolen
If it's a third party authorised by Groupon, then that's still their responsibility. It can't be a third party doing it without Groupon's cooperation.
Sep
4
answered Email address book stolen
Aug
1
answered Using a Public-Key-Encryption browser side to avoid PCI compliance