Reputation
34,592
Next tag badge:
95/100 score
18/20 answers
Badges
5 55 134
Newest
 Enlightened
Impact
~2.0m people reached

Jul
27
comment Can client-side hashing improve after-the-fact security in response to password leaks?
@Veedrac Google may not use this method for HTTP authentication because the security gain is only in edge cases, and it is fairly complex to do correctly. Zero password proofs are useful, but two-factor authentication protects against a much broader category of attacks. Google Authenticator is a cool service.
Jul
27
revised Can client-side hashing improve after-the-fact security in response to password leaks?
added 71 characters in body
Jul
26
revised Can client-side hashing improve after-the-fact security in response to password leaks?
added 286 characters in body
Jul
26
answered Can client-side hashing improve after-the-fact security in response to password leaks?
Jul
24
comment Using .apk files to reverse_tcp and exploit on android?
I have no idea what you are asking. Consider reading about common mobile vulenrablites: owasp.org/index.php/Projects/…
Jul
22
awarded  Nice Answer
Jul
21
comment .JPEG File upload shell via EXIF comments
@lynks If the script is dropped into the webroot, then the attacker wouldn't need the include(), it can be executed directly. +1 sounds legit.
Jul
17
awarded  Nice Answer
Jul
8
comment Creating a P2P hosted website
@Jeremy French Yes, the website is free to run JavaScript and use localstorage. A server-side web application would require Tor.
Jul
6
answered Creating a P2P hosted website
Jul
4
revised Techniques for Anti Virus evasion
added 34 characters in body
Jul
2
comment Techniques for Anti Virus evasion
@SilverlightFox oah yeah this post was ooold. updated.
Jul
2
revised Techniques for Anti Virus evasion
deleted 204 characters in body
Jul
1
awarded  Popular Question
Jun
24
comment My Virgin Media account password is visible in plaintext to call center staff. What do I do?
What a noob mistake, you should report them: plaintextoffenders.com
Jun
17
awarded  Good Question
Jun
14
awarded  Enlightened
Jun
14
awarded  Nice Answer
Jun
4
comment Is it possible to do HTTP header injection if CR/LF are stripped?
@immibis yeah \n works alone for all servers/clients in common use. More broadly every CRLF delimited protocol will usually just accept a LF as a delimiter. Don't take my word for it, load up netcat and try it for yourself.
May
28
awarded  Famous Question