13,728 reputation
852117
bio website security.stackexchange.com
location Florida
age 32
visits member for 4 years, 2 months
seen Mar 19 at 20:57

I'm not the droid you're looking for.


Mar
23
awarded  Popular Question
Mar
19
comment How can I be sure Lastpass really can't access my passwords?
@OlivierCailloux This is a public Q&A site which has zero affiliation with LastPass whatsoever. While I agree that it would be great to see a published audit, I think it speaks volumes that anyone at LastPass has bothered to comment here at all.
Mar
19
comment Is there any way to check the certificates in a client's root CA store?
@Xander Good point - putting an even sharper "spear" in "spear phishing".
Mar
19
revised Is there any way to check the certificates in a client's root CA store?
added 125 characters in body
Mar
19
answered Is there any way to check the certificates in a client's root CA store?
Mar
19
reviewed Close TLS based Server/Client PKI application
Mar
19
reviewed Close How can I detect mode interface of other machine is promiscuous
Mar
17
reviewed Close How does a reverse proxy change the security posture of a web server residing in the DMZ?
Mar
17
reviewed Close How secure is Jitsi VoIP/IM Android app?
Mar
17
reviewed Close Secure software development checklist
Mar
13
comment How strong is visualCaptcha?
I'd argue this is actually weaker. A lot of Captcha circumvention services these days are actually using humans instead of computers. For a human, it's much faster to click on one thing than it is to type several characters or a couple of words. Therefore a human-driven Captcha circumvention service would be able to attack this form at a significantly higher rate than traditional Captcha.
Mar
12
comment Is sending passwords through cellphone text messages secure?
@supercat Also, the question here appears to not particularly be about a "one time code" case. It seems to be regarding password sharing between individuals.
Mar
12
comment Is sending passwords through cellphone text messages secure?
@supercat True, but ultimately that is still after-the-fact mitigation. You're dealing with a security compromise that could/should have been avoided by using more secure communications channels and/or implementing other, more robust security enhancements.
Mar
10
reviewed Close NMAP Scan Returns Odd OS Detection
Mar
10
comment NMAP Scan Returns Odd OS Detection
We definitely need more information about the original nmap options used, and further details from the nmap output. Also, it would be helpful to know what the device actually is - if you're "100% certain that this device is not a printer" then you must have some amount of certainty about what it is.
Mar
10
comment How to enforce TLS on Windows
@Escoce That's definitely going to cover the bulk of your work, but be very mindful of the last few paragraphs - particularly the bit about SSL/TLS not only being for websites, and how non-Microsoft applications are not necessarily affected by those Registry entries.
Mar
10
reviewed Close Is it legal to find bugs on a website and report them to the website's owner?
Mar
10
reviewed Close How can I successfully perform an xss attack on a dummy website?
Mar
10
reviewed Close At what point does “hacking” become illegal? (US)
Mar
10
reviewed Close How to create certificates for local network