57,333 reputation
397268
bio website
location
age
visits member for 3 years, 10 months
seen yesterday

2d
awarded  Popular Question
Nov
17
awarded  Nice Answer
Nov
12
comment Should every output element be filtered, or just those which contain user-editable data?
Read security.stackexchange.com/q/9415/971. Notice the recommendation there for a consistent policy. Then note the implication for your question: this means that it's best to consistently apply output escaping to everything, even data you don't think is under user control.
Nov
12
revised Should every output element be filtered, or just those which contain user-editable data?
Choose a title that is more descriptive of the actual question. Hone the question down to be a bit more specfic.
Nov
11
comment How bad is it to truncate a hash?
We can probably give you better answers if you give us more context. (a) What are you using the truncated hash for? What properties do you need? Uniqueness? Do you have to deal with adversaries who can choose an input? What's the adversary model (threat model)? (b) Can you choose a random salt and store that? (Either the same salt for all hashes, or a different salt for each hash?)
Nov
7
comment Why do some known vulnerabilities have no CVE ID?
Can you point to specific examples to make your question more concrete? Otherwise, it's likely going to be hard to answer this question.
Nov
6
awarded  Nice Answer
Nov
3
awarded  Announcer
Oct
31
comment How to securely hash passwords?
This is not good advice -- this answer recommends using a fast hash, which is a very bad idea (as explained in other answers).
Oct
30
awarded  Nice Answer
Oct
28
reviewed Reject suggested edit on Is Django's built-in security enough?
Oct
28
comment Sequential password updates
You're right to worry about the security implications of storing a bunch of old password hashes. Now an attacker has multiple targets; even if he can't crack the current password hash, he might still get lucky and crack the old password hash, which might help the attacker attack the user's other accounts on other systems -- or might even help the attacker attack the user's current password on this site, if the user is following some kind of pattern in selecting his password. The risk gain/loss equation is non-trivial; it's not clear whether the modest gain is worth the modest additional risk.
Oct
28
comment Sequential password updates
Please read security.stackexchange.com/q/4704/971. Forcing your users to change their passwords periodically is usually a bad practice, one that harms security more than it helps.
Oct
24
awarded  Announcer
Oct
24
awarded  Nice Answer
Oct
24
comment Is it possible to force a browser to use http in an ssl enabled (https) website?
1. The answer to your question will depend on how the server behaves; we don't have enough information to say. Some servers will serve pages under both HTTP and HTTPS; some won't. What have you tried? Have you tried changing the https: in the URL to http: and trying to visit that address, to see how the server responds? 2. Why can't you tag the cookie secure? Have you looked at HSTS? What research have you done?
Oct
22
comment Is there anything preventing the NSA from becoming a root CA?
@NDF1, That citation leaves something to be desired. National security letters (NSL's) predate the PATRIOT act. The PATRIOT act did not create NSL's.
Oct
21
comment Is there anything preventing the NSA from becoming a root CA?
This is pure speculation, with no citations. There are a lot of misconceptions out there about what the PATRIOT act actually says, and this looks like yet another instance of that. Speculation about legal matters from non-legal experts, without citations or evidence to back it up, is not very useful.
Oct
21
awarded  Nice Answer
Oct
20
awarded  Announcer