31,872 reputation
346116
bio website bishopfox.com
location
age
visits member for 4 years, 3 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Mar
1
revised How to safely display html emails like gmail does it?
added 2 characters in body
Mar
1
revised How to safely display html emails like gmail does it?
added 34 characters in body
Mar
1
answered How to safely display html emails like gmail does it?
Feb
24
awarded  Popular Question
Feb
24
revised Cross site scripting and the use of http-only cookies?
added 1 character in body
Feb
23
awarded  Enlightened
Feb
23
awarded  Nice Answer
Feb
18
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
@Daniel Magliola The only one you are fooling with cargo-cult security is yourself.
Feb
18
revised How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
added 147 characters in body
Feb
18
comment Session Authentication vs Token Authentication
@SilverlightFox Interesting, I was not aware of that weakness. Not surprising coming from Microsoft.
Feb
17
answered Using INTO OUTFILE with INSERT
Feb
17
comment Using INTO OUTFILE with INSERT
@Mints97 did you even try this? Sub-selct doesn't allow into outfile.
Feb
17
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
SSL was deprecated over a decade ago, I sure hope you aren't using SSL. TLSv1 or later is the only acceptable secure transport layer.
Feb
17
answered How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
Feb
16
comment Session Authentication vs Token Authentication
@Hoax that is a separate question. The OAuth flow is really useful.
Feb
16
revised Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
added 19 characters in body
Feb
16
comment Session Authentication vs Token Authentication
@davis_m good point, updated.
Feb
16
revised Session Authentication vs Token Authentication
added 55 characters in body
Feb
16
comment Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
@ThePhysicist and the answer was clearly provided. In order to restrict access, you need something you control.
Feb
16
comment Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
@ThePhysicist ok, you still can't give the attacker the access_token, which means you can't send it to the desktop client, this must never happen. Crypto isn't magic, you can't hide in plain sight.