Reputation
33,155
Next tag badge:
94/100 score
25/20 answers
Badges
4 49 124
Newest
 Nice Answer
Impact
~1.7m people reached

Feb
16
revised Session Authentication vs Token Authentication
added 55 characters in body
Feb
16
comment Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
@ThePhysicist and the answer was clearly provided. In order to restrict access, you need something you control.
Feb
16
comment Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
@ThePhysicist ok, you still can't give the attacker the access_token, which means you can't send it to the desktop client, this must never happen. Crypto isn't magic, you can't hide in plain sight.
Feb
16
revised External cross domain include script
deleted 4 characters in body
Feb
16
comment External cross domain include script
This is a security issue, and for any reasonably complex app there should be no less than 1,000 vulnerabilities that are more important than this one.
Feb
16
revised External cross domain include script
added 6 characters in body
Feb
16
revised External cross domain include script
added 143 characters in body
Feb
16
comment External cross domain include script
This is an easy finding that is commonly reported by Burp Scanner. If a pentester is reporting this issue, then they have weak findings and are scrambling to get a report together.
Feb
16
answered External cross domain include script
Feb
16
answered Session Authentication vs Token Authentication
Feb
16
comment Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
SSL should not be used by anyone, TLS 1.0 and later should be deployed by all services.
Feb
16
answered Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application
Feb
16
comment How to make database of IP addresses anonymous?
@Pacerier An IP Address filter alone is almost never a good idea, ideally there would be some other access control system.
Feb
16
revised Would an unnecessarily long password degrade performance of a WPA2 wireless network?
added 1 character in body
Feb
12
comment SAML Without Session
This question needs more information. I think what you are suggesting is horribly insecure and should not be done. The client cannot be trusted.
Feb
11
awarded  Enlightened
Feb
11
awarded  Nice Answer
Feb
11
revised What is the HTTP “Server” response-header field used for?
added 1 character in body
Feb
9
comment Content management url security
@SexyMF cloudflare blocks bots from exploiting the DoS vulnerability that has been introduced to wordpress instance. It 100% solves the symptoms of your weakness, but not the underlying problem. The DoS vulnerability should be completely and totally addressed by the first bullet point.
Feb
9
revised penetration testing first step
added 65 characters in body