meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year |
| seen | Apr 30 at 15:37 | |
| stats | profile views | 30 |
ca51ce1fb15acc6d69b8a5700256172fcc507e02073e6f19592e341bd6508ab8
|
Apr 9 |
comment |
How does SSL work? I'm printing this answear for my Security Management exam. |
|
Sep 19 |
comment |
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work? Seems like a buffer overflow. |
|
Aug 31 |
comment |
Is not checking the src url a vulnerability? And, apart from CSRF, are there other ways to exploit it? |
|
Aug 30 |
comment |
Is not checking the src url a vulnerability? It sanitizes, I updated the question to show how. BTW I made a little mistake, img tag does not have the href attribute, it is src ;) |
|
Aug 30 |
comment |
Is not checking the src url a vulnerability? I edited the question, now you can see how it is done. BTW I made a little mistake, img tag does not have the href attribute, it is src ;) |
|
Aug 30 |
comment |
Is not checking the src url a vulnerability? @adric I mean, if you let the user to introduce any valid url in the href, could it be exploited? |
|
Aug 23 |
comment |
Is asymmetric encryption ever recommended for long-term storage? I find your system pretty secure, although let ear some expert's advices... |
|
Aug 23 |
comment |
I'm currently receiving a targeted attack And, could it be a faked sender, using some tools like FakeMailer, so his friend email account has not been compromised, but the attackers knows it, and is trying to phish him? |
|
Aug 22 |
comment |
How to determine if a browser is using an SSL or TLS connection? please, specify what browser you are using |
|
Aug 22 |
comment |
how to identify whether my page is phished or normal page? @Polynomial do you mean something like, when the user clicks the submit button, the script changes the action attribute? |
|
Aug 22 |
comment |
how to identify whether my page is phished or normal page? @dippu the action attribute could be legitimate, but the phising website could have a script that sends all the information you wrote to other place... |
|
Aug 22 |
comment |
how to identify whether my page is phished or normal page? @vignesh I think that the advice, checking the https, is a good advice, websites with fake https are exceptions, but we could not ignore that possibility. But appart from that, I would concentrate my efforts in making them aware of the risks of internet and, since most of phising cases are perpetrated via email, let them know that they should never open, or click links of, emails from unknown sources, banks (they never send emails), and in general any email that they have not requested. In a nutsell, do not trust your emails. And with chatrooms etc. it is exactly the same. |
|
Aug 22 |
comment |
Where and How is data stored in a session? I added other question: "If I store an object of a class, in wich way is it stored? Like $_SESSION['kart'] = new Kart(10). Could someone get the information stored in that class? How?" Could you explain how the data is stored in these documents? |
|
Aug 22 |
comment |
Instant access to application using token in url @jcubic it is not secure, but forgot brute force, if the url has a long-live token, it could be sniffed or if someone looks the history of the browser, the account would be compromised. Also, have you consider race conditions? if two users gets/requests the url at the same second... time() works with seconds, so you could end up with two users with the same token, and then what? |
|
Aug 21 |
comment |
What can a hacker do with an IP address? +1 good metaphor |
|
Aug 17 |
comment |
How to convince your boss about importance of IT security (I am from Spain) I found an article of a law which says (Translation from Spanish): "[...] while it(password) is still being valid, it must be stored unintelligible" |
|
Aug 17 |
comment |
How to convince your boss about importance of IT security I found an article of a law which says (Translation from Spanish): "[...] while it(password) is still being valid, it must be stored unintelligible" Do you think is a good aporach telling this to my boss by email? |
|
Aug 8 |
comment |
Is sha-1 hash always the same? I was not sure if the hash is different for the same string if you hash it using linux and then with windows |
|
May 6 |
comment |
Why is the diffusion property important in hash functions But if you are using the hashing function just to guarantee the integrity of a document. Is it needed? |
