Reputation
1,458
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 12 25
Newest
 Yearling
Impact
~59k people reached

Apr
12
awarded  Yearling
Feb
4
awarded  Popular Question
Jan
12
awarded  Cleanup
Jul
25
comment How can mini-computers (like Raspberry Pi) be applied to IT security?
Here's a recent article that talks about Raspberry Pi in the security field.
Jul
16
awarded  Caucus
Jun
24
awarded  Notable Question
May
13
awarded  Notable Question
Apr
14
awarded  Good Question
Apr
12
awarded  Yearling
Feb
20
awarded  Famous Question
Dec
31
revised Does cynicism have a valid role in information security?
fixed wording
Dec
31
asked Does cynicism have a valid role in information security?
Sep
24
awarded  Autobiographer
Aug
25
comment Why is “www.” considered unsafe in this HTTPS URL?
Web security strongly relies on hostnames. And a hostname www.soundcloud.com is not the same as soundcloud.com -- browsers and SSL certs are very strict about this. (And there are right and wrong ways to configure servers to handle these discrepancies. Sometimes mistakes, like a faulty 301 redirect, cause errors like this.)
Aug
15
comment What are the security reasons for disallowing the plus sign in email addresses?
@JamesT.Huggett At that point it's more of an engineering/UX problem than a real security issue. There's ways to strip out or ignore the "plus" portion of a Gmail address and check for duplicates. It can be inconvenient to implement, but it gives more security/control to the user.
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
Oh, I dunno about that. Their site works really well for arranging meetups and I've enjoyed the ones I've attended. Though the problem may reflect a poor UX decision, if all it takes is to change some regular expression, that really has little to do with the effectiveness of the service as a whole.
Aug
13
awarded  Notable Question
Aug
13
awarded  Good Question
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
The DBA perspective is refreshing, thanks! I would suppose, though, that a little pre-processing of the email address to strip out the plus-portion could save that extra query. This steps into UX bounds, but is interesting since, as you suggest, I should be able to change my email address to have a plus-sign later without negative consequence. (I agree; but I doubt most sites implement it that way.)
Aug
13
accepted What are the security reasons for disallowing the plus sign in email addresses?