28,087 reputation
23197
bio website bishopfox.com
location
age
visits member for 3 years, 6 months
seen Jul 24 at 19:06

Do not trust any security related answers you see on StackOverflow/Security.StackExchange. Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is almost never chosen.

Test everything, trust no one.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Sep
18
revised Securing the hardware of my computer against remote exploits
added 43 characters in body
Sep
17
revised Securing the hardware of my computer against remote exploits
added 360 characters in body
Sep
17
comment Securing the hardware of my computer against remote exploits
@Luc oah right, I updated my post.
Sep
16
answered Securing the hardware of my computer against remote exploits
Sep
16
revised OAuth access token vs session key
deleted 21 characters in body
Sep
16
revised How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
edited body
Sep
16
revised How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
edited body
Sep
16
answered How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
Sep
16
revised OAuth access token vs session key
added 11 characters in body
Sep
16
answered OAuth access token vs session key
Sep
12
comment Vulnerable java applications
@X-Zero i don't see how this applies to my post. Performing a backbox analysis of a publicly available applications is inefficient to say the least.
Sep
12
revised Vulnerable java applications
added 84 characters in body
Sep
12
answered Vulnerable java applications
Sep
12
comment Estimating the size of a rainbow table
@asudhak nope, that is a lookup table, not a rainbowtable.
Sep
11
comment Estimating the size of a rainbow table
@David Wachtfogel good point.
Sep
11
revised Estimating the size of a rainbow table
added 58 characters in body
Sep
11
answered Estimating the size of a rainbow table
Sep
11
comment Protecting against CSRF when a form is being submitted via an AJAX call
Yes, but you cannot set the cookie header in a CSRF attack.
Sep
11
comment Protecting against CSRF when a form is being submitted via an AJAX call
@Gumbo hmm i think both the OP and my post are explaining the same security measure. However, I can see how this measure is confusing.
Sep
11
comment Protecting against CSRF when a form is being submitted via an AJAX call
@Gumbo By the nature of AJAX requests, the domain of origin will need to have access to the token value in order to build valid requests. However, JavaScript originating from another domain should never be allowed access to this variable. An attacker can obtain the cookie value and the CSRF token with XSS, but this is always true for token based CSRF protection, HTTPOnly cookies doesn't help.