28,095 reputation
23197
bio website bishopfox.com
location
age
visits member for 3 years, 6 months
seen 2 days ago

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
20
revised Can too much web searching be a danger to a security professional?
added 37 characters in body
Dec
19
answered How does the stack cookie protect return address from being overwrite
Dec
18
comment Would siloing passwords into their own locked down schema improve security?
@Andrew Hoffman that is a great example of violating the principle of least privilege access.
Dec
18
revised Would siloing passwords into their own locked down schema improve security?
added 122 characters in body
Dec
18
answered Would siloing passwords into their own locked down schema improve security?
Dec
17
revised Is Django's built-in CSRF protection enough?
added 13 characters in body
Dec
17
revised Is Django's built-in CSRF protection enough?
added 126 characters in body
Dec
17
answered Is Django's built-in CSRF protection enough?
Dec
17
comment Is it safe to use PBKDF2 for hashing?
PBKDF2 cannot be efficiently implemented on a GPU because of the XOR operation performed between each iteration of the hash function.
Dec
17
comment Microsoft IIS Express
Perhaps you should ask your manager.
Dec
17
comment Protecting sensitive content in JS source code and Ajax cals
It is unclear why HTTPS is not sufficient.
Dec
16
comment How are zero days found?
Every day is full of zero days when you are an avid security researcher.
Dec
16
revised handle user-session-cookie and csrf token correctly for javascript app
added 33 characters in body
Dec
16
comment Getting rid of trojans on Windows XP - the basic toolkit
Re-install. Also XP will no longer receive security updateds in a few months. So that is something to look forward to.
Dec
16
comment Does Skype Trump SSLStrip?
Microsoft is ignoring the RFC's to address SSLStrip, IE contains more known vulnerabilities than any other piece of activity maintained code. The reflective XSS filter is completely and totally non-functional.
Dec
15
revised Hiding Bittorent clients
added 35 characters in body
Dec
14
comment What are the security implications of people downloading addons, wrongly thinking that they are safe?
@Martin Vegter I think there has been one or two cases of malware on addons.mozilla.org... which is a good sign because it means the community is finding and removing malware.
Dec
14
comment What are the security implications of people downloading addons, wrongly thinking that they are safe?
@Martin Vegter downloading a firefox addon that wasn't from addons.mozilla.org
Dec
13
comment File system history on USB drives
@olamotte This is not the role of a filesystem, but an application can use a filesystem to perform this action.
Dec
13
comment Site preventing user from closing tab/closing browser
@Jan Schejbal It is must worse than I expected: bugzilla.mozilla.org/show_bug.cgi?id=636374 . This bug maybe exploitable for a few more years :*(. Looks like I'll be using Chromium more often.