30,014 reputation
336107
bio website bishopfox.com
location
age
visits member for 3 years, 10 months
seen 3 hours ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
6
revised How can a web application protect IE users when this browser doesn't support HSTS?
added 109 characters in body
Nov
6
answered How can a web application protect IE users when this browser doesn't support HSTS?
Nov
6
asked How can a web application protect IE users when this browser doesn't support HSTS?
Nov
6
comment How should permissions be stored?
What type of database are you using? Also, this is more of an SO question.
Nov
6
comment Should we force user to HTTPS on website?
@tylerl THat is a good question that probably deserves its own post. Really a redirect is just addressing a symptom of a problem. Having a redirect is a good thing, but you need to address mixed content vulnerabilities that would cause this to happen in the first place. Also set the "secure" flag on session id's. Also warn IE users that they are potentially vulnerable to attack.
Nov
6
comment Should we force user to HTTPS on website?
@tylerl Depends who you ask: w3schools.com/browsers/browsers_stats.asp . Personally I don't know anyone that uses IE. And you could not be more wrong about the redirect, the attacker can send whatever response they would like in a MITM attack, and SSLStrip will remove the https redirect for you. I am actually surprised i am even debating this, i thought this was obvious.
Nov
6
revised Should we force user to HTTPS on website?
added 26 characters in body
Nov
6
comment Should we force user to HTTPS on website?
@tylerl Throwing a 302 redirect over http to an https connection is trivial to exploit. If you don't see how this is serious problem, fire up wireshark and look at the traffic. HSTS is supported by chrome and firefox, which is the STRONG MAJORITY of browsers. IE has never been known for security, so i wouldn't be surprised if they just ignored this feature.
Nov
5
comment What is HiASLR?
i think you are confusing ForceASLR with High Entropy ASLR. related: blogs.msdn.com/b/ie/archive/2012/03/12/…
Nov
5
comment Can I encrypt a file incrementally?
You should get someone with experience to implement security systems. A lot can go wrong with cryptographic implementations.
Nov
5
revised Can I encrypt a file incrementally?
added 1 characters in body; edited title
Nov
5
comment What alternatives are there to the existing Certificate Authority system for SSL?
@makerofthings7 not that I know of.
Nov
5
answered What alternatives are there to the existing Certificate Authority system for SSL?
Nov
5
comment What is HiASLR?
Why was it ever "low entropy"? Who thought that was a good idea?
Nov
5
answered Should we force user to HTTPS on website?
Nov
5
comment Should we force user to HTTPS on website?
You should probably read the OWASP top 10.
Nov
4
answered Bypassing Trusted Computing
Nov
3
answered Digest authentication - client side
Nov
2
comment Drupal filters XSS with regexes. What could bypass it?
@greggles I am not sure how you came to that conclusion. I am saying that its impossible to write some magical function that prevents all of XSS. A regular expression should be able to process any regular language... although it maybe be difficult to do so.
Nov
2
answered What are the security implications of allowing unlimited size cookies?