30,373 reputation
338108
bio website bishopfox.com
location
age
visits member for 3 years, 11 months
seen 24 mins ago

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Nov
19
comment Insider threats for Private Clouds
As far as security questions go, this is most unsexy.
Nov
19
comment Preventing insecure webapp on subdomain compromise security of main webapp
@Ram Rachum that doesn't sound like a SoP abuse, unless you set the x-frame-options...
Nov
18
answered Comparison between Data Encryption Tools and Data Sanitization Tools
Nov
18
answered Preventing insecure webapp on subdomain compromise security of main webapp
Nov
18
revised Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?
deleted 106 characters in body
Nov
18
comment What Type Of Encoding Is This?
+1 Hah, good call. Also confirming that it has nothing to do with real security.
Nov
18
comment Stopping Session Hijacking
@ub3rst4r If you think you need something completely new to defend against something everyone has to deal with, you are doing it wrong.
Nov
18
answered Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?
Nov
18
comment Stopping Session Hijacking
This must be the 5th time I have answered this question this week.
Nov
18
answered Stopping Session Hijacking
Nov
18
comment What Type Of Encoding Is This?
... and what does that have to do with security?
Nov
18
comment What Type Of Encoding Is This?
Umm... Some kind of compression that adheres to the zip file container? What does this have to do with security? Voting to close.
Nov
16
comment Webmail host knows my password
Oah "Plain Text Offenders" as in a list of people that you should hack if you want a large database of plaintext passwords.
Nov
15
awarded  Good Answer
Nov
15
comment applications of linear algebra to “security”?
yeah but that is a very different branch of math.
Nov
15
answered applications of linear algebra to “security”?
Nov
15
awarded  Nice Answer
Nov
15
comment Webmail host knows my password
No I'm sorry but there is no excuse for this.
Nov
15
comment Webmail host knows my password
@Stephen Touset totally agree.
Nov
15
revised Webmail host knows my password
added 60 characters in body