lucho

342 reputation

bio	website
	location	Bulgaria
	age	34
visits	member for	1 year
	seen	Feb 22 at 9:11
stats	profile views	16

	342 reputation	bio	website		visits	member for	1 year
17 badges		location	Bulgaria		seen	Feb 22 at 9:11

summary answers questions tags badges favorites bounties reputation activity

32 Actions

suggestions reviews revisions comments badges posts accepts all

2d	awarded	Yearling
Mar 17	awarded	Popular Question
Oct 19	awarded	Commentator
Oct 19	comment	How to encrypt database connection credentials on a web server? With all my respect to OWASP this article is just a small stub with links to empty or dead pages. I wouldn't consider it truly seriously.
Oct 15	comment	What key does Linux use when storing user passwords? @this.josh or think about it in another way - there is infinite amount of passwords but only finite amount of hashes ;)
Oct 11	accepted	Vulnerability scoring systems
Oct 3	comment	Vulnerability scoring systems @Polynomial so it seems to me that if we want to communicate the technical impact we would have to skip the environmental metrics?
Oct 3	comment	Vulnerability scoring systems @Polynomial we have clients that make 3 orders per day but there are some with 3000 and there are many that refuse to give such information at all. So it is difficult to estimate how much will cost us or them. Does it mean that we should skip the environmental metrics altogether? Or we may create a rough estimation (actually CVSS does not contain any numbers)? And is it reliable to communicate CVSS scores to clients without including these metrics?
Oct 3	comment	Vulnerability scoring systems What you say is correct and the CVSS addresses it in its environmental metrics, more specifically in the "Collateral Damage Potential" and to certain extent in the "Security Requirements". Of course "money" is replaced with "property" :-). I deliberately noted, that we skip the environmental metrics since it is really very specific to the different client. A minor DoS attack may be serious for a big client but is not an issue for some smaller players. Thus we cannot really evaluate this on our side.
Oct 3	asked	Vulnerability scoring systems
Sep 24	revised	Why do some sites prevent users from reusing their old passwords? added 215 characters in body
Sep 24	answered	Why do some sites prevent users from reusing their old passwords?
Sep 19	answered	Why encrypt data in memory?
Sep 17	answered	Software that encrypts the data before deleting it
Sep 14	accepted	Information disclosure by identifiers
Sep 14	asked	Information disclosure by identifiers
Jun 29	comment	Are passwords made up from concatenating a few foreign words better than shorter random characters? I think that you need to provide "more context" into this question. E.g. what is "paraphrase" and where/how you use it.
May 20	comment	How to use 'key material' so that multiple people can access protected files? In the scenario the key Kf was only one and it was encrypted with the public keys of all three players (we have three key records + one encrypted file). When the file is shared to Charlie, Kf is encrypted with Charlie's public key too. (Four records and the file remains the same). This sounds pretty scalable to me... But again - I have no real experience with that, I just share what someone else told me :-)
May 19	revised	How to use 'key material' so that multiple people can access protected files? added 12 characters in body
May 19	answered	How to use 'key material' so that multiple people can access protected files?