357 reputation
27
bio website
location Bulgaria
age 35
visits member for 2 years, 2 months
seen Mar 19 at 8:23

Jun
2
awarded  Notable Question
May
17
awarded  Yearling
Mar
17
awarded  Popular Question
Oct
19
awarded  Commentator
Oct
19
comment How to encrypt database connection credentials on a web server?
With all my respect to OWASP this article is just a small stub with links to empty or dead pages. I wouldn't consider it truly seriously.
Oct
15
comment What key does Linux use when storing user passwords?
@this.josh or think about it in another way - there is infinite amount of passwords but only finite amount of hashes ;)
Oct
11
accepted Vulnerability scoring systems
Oct
3
comment Vulnerability scoring systems
@Polynomial so it seems to me that if we want to communicate the technical impact we would have to skip the environmental metrics?
Oct
3
comment Vulnerability scoring systems
@Polynomial we have clients that make 3 orders per day but there are some with 3000 and there are many that refuse to give such information at all. So it is difficult to estimate how much will cost us or them. Does it mean that we should skip the environmental metrics altogether? Or we may create a rough estimation (actually CVSS does not contain any numbers)? And is it reliable to communicate CVSS scores to clients without including these metrics?
Oct
3
comment Vulnerability scoring systems
What you say is correct and the CVSS addresses it in its environmental metrics, more specifically in the "Collateral Damage Potential" and to certain extent in the "Security Requirements". Of course "money" is replaced with "property" :-). I deliberately noted, that we skip the environmental metrics since it is really very specific to the different client. A minor DoS attack may be serious for a big client but is not an issue for some smaller players. Thus we cannot really evaluate this on our side.
Oct
3
asked Vulnerability scoring systems
Sep
24
revised Why do some sites prevent users from reusing their old passwords?
added 215 characters in body
Sep
24
answered Why do some sites prevent users from reusing their old passwords?
Sep
19
answered Why encrypt data in memory?
Sep
17
answered Software that encrypts the data before deleting it
Sep
14
accepted Information disclosure by identifiers
Sep
14
asked Information disclosure by identifiers
Jun
29
comment Are passwords made up from concatenating a few foreign words better than shorter random characters?
I think that you need to provide "more context" into this question. E.g. what is "paraphrase" and where/how you use it.
May
20
comment How to use 'key material' so that multiple people can access protected files?
In the scenario the key Kf was only one and it was encrypted with the public keys of all three players (we have three key records + one encrypted file). When the file is shared to Charlie, Kf is encrypted with Charlie's public key too. (Four records and the file remains the same). This sounds pretty scalable to me... But again - I have no real experience with that, I just share what someone else told me :-)
May
19
revised How to use 'key material' so that multiple people can access protected files?
added 12 characters in body