27,469 reputation
22892
bio website bishopfox.com
location
age
visits member for 3 years, 3 months
seen yesterday

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
11
awarded  Popular Question
Dec
11
comment XSS when <, > and " are escaped
I believe this is well documented.
Dec
10
revised Why is activex said to be insecure?
added 58 characters in body
Dec
10
revised Why is activex said to be insecure?
added 10 characters in body
Dec
10
answered Why is activex said to be insecure?
Dec
10
comment How to retrieve the admin's password of a webapp?
Sounds like a challenge, and if you can't pass the challenge, then it looks like this test did its job.
Dec
10
awarded  Popular Question
Dec
9
revised Hiding Bittorent clients
added 620 characters in body
Dec
9
answered Hiding Bittorent clients
Dec
9
comment Token based authentication under http
@Timespace7 Facebook uses an OAuth token passed as a cookie or HTTP header and protected by HTTPS.
Dec
9
awarded  Nice Question
Dec
8
comment Evil certificate authority in public-key-infrastructure
Why is the CA sending a public key to Bob? A CA just signs certificates, it doesn't transmit keys for verification. The PKI is used to verify a chain of trust on the local system, without contacting the CA directly (well unless the client needs to check the CRL). But its not bad question, because there are Evil CA's in our PKI and this is a huge concern for some people.
Dec
8
revised Is there an advantage to applying pbkdf2 to a key that's used to generate a MAC?
deleted 22 characters in body
Dec
8
answered Is there an advantage to applying pbkdf2 to a key that's used to generate a MAC?
Dec
7
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
@Polynomial My answer was poorly worded, it should be more agreeable now.
Dec
7
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
@CodesInChaos you are right.
Dec
7
revised Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
added 91 characters in body
Dec
7
revised Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
deleted 8 characters in body
Dec
7
revised Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
added 39 characters in body
Dec
6
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
Ah, I misinterpreted your post. We are on the same page now, +1.