Reputation
35,370
Next tag badge:
90/100 score
20/20 answers
Badges
5 58 137
Impact
~2.2m people reached

Oct
21
comment Why refresh CSRF token per form request?
If you have an XSS vulnerability you can use an XHR to read any page and submit any request. Having a different token on each page doesn't help.
Oct
21
revised How does the Copyright Alert System work? Who has implemented it?
added 219 characters in body
Oct
21
answered How does the Copyright Alert System work? Who has implemented it?
Oct
21
answered Are open redirects a security concern?
Oct
20
comment Why refresh CSRF token per form request?
@CodesInChaos That works fine on paper, but this proposed attack is considerably less likely to succeed in a real world scenario.
Oct
20
comment Why refresh CSRF token per form request?
@CodesInChaos the attacker would have to know the password, and then its a moot point.
Oct
20
answered How far should I go in creating anonymity?
Oct
20
revised Why refresh CSRF token per form request?
added 166 characters in body
Oct
20
comment Why refresh CSRF token per form request?
-1 I'm sorry but i don't want people to get the idea that if they use a single submit token they are magically protected against XSS, because that is most untrue. If a user can do it in a web browser, then xss can do it in a web browser.
Oct
20
answered Why refresh CSRF token per form request?
Oct
19
answered How attacker can access victim's account without knowing its credentials?
Oct
18
comment What are methods for preventing browser hooking / drive-by downloads?
@Null Ah yes, the line between security and paranoia. Interesting place.
Oct
18
comment attack/abuse notification email template
@tylerl hmm, offloading boring corporate drivel onto the community... for Karam :)
Oct
18
answered What are methods for preventing browser hooking / drive-by downloads?
Oct
18
comment If I storing my own cards in a database. Does this fall under PCI compliance framework?
@Clockwork-Muse Well the configuration file has the login information to the database, so that is a moot point. Directory Traversal is less common than SQL Injection... Really this design deserves its own post.
Oct
18
comment Can malware on my computer infect my phone?
@Polynomial that happened! It delivered a remote code execution exploit via a PDF and then jailbroke the iphone. Crazy stuff.
Oct
17
answered Can malware on my computer infect my phone?
Oct
17
answered If I storing my own cards in a database. Does this fall under PCI compliance framework?
Oct
16
comment How to determine level of security required for this kind of site?
@farleyknight You have just asked to describe an entire profession.
Oct
15
comment How to determine level of security required for this kind of site?
@farleyknight It depends on how good the prosecuting attorney is. Personally, I'd be wary of leaking someone's favorite color.