1,555 reputation
11028
bio website serverfault.com
location
age 34
visits member for 4 years, 9 months
seen Oct 22 at 5:57

Do not trust any security related answers you see on SO. Not from me, not from anyone. There are very smart people on SO and there are excellent answers given, although the right answer is almost never chosen. Test everything, trust no one.

I have been writing exploit code for more than 4 years. I have spoken 3 years in a row at DEFCON. Currently I am the top answerer and asker of security questions on Stack Overflow.

I actively hunt for vulnerabilities and I have found many over the years. According to the Department of Homeland I have found a vulnerability with a severity metric of 13.5 which makes it into the top 1,000 most dangerous of all time and the most dangerous CSRF vulnerability ever discovered.


Aug
20
comment SSH config file?
Belongs on server fault.
Aug
9
comment Which bots and spiders should I block in robots.txt?
@Farseeker I do not see a problem with punishing the ones who break the rules. Although tricking spammers with bad data is an interesting twist.
Aug
9
awarded  Nice Answer
Aug
9
comment Which bots and spiders should I block in robots.txt?
@Steven Sudit that is not a bad idea. This would be called a honey pot.
Aug
9
answered Which bots and spiders should I block in robots.txt?
Aug
6
comment keylogger security
@Michael Kohne your right the paper is entitled "Sniffing Keystrokes With Lasers and Voltmeters", its a good read i posted a link to it in my post.
Aug
6
comment keylogger security
Actually no, I just found out that van eck phreaking does work with LCD (en.wikipedia.org/wiki/Van_Eck_phreaking)
Aug
6
comment keylogger security
@Bill Weiss Okay fine, "Van Eck Phreaking", which has absolutely nothing to do with this question.
Aug
6
revised keylogger security
added 39 characters in body
Aug
6
comment keylogger security
i think the OP is mistaken, i don't see how TEMPEST relates to this question at all. Although props on knowing a lot about this.
Aug
6
revised keylogger security
deleted 5 characters in body
Aug
6
revised keylogger security
deleted 126 characters in body; deleted 42 characters in body
Aug
6
answered keylogger security
Jul
27
comment Card Reader and Software
@Robert if the three links i posted isn't enough information then i'm sorry but i don't think anyone can help. A smartcard has doesn't require multi-factor authentication. Apples and oranges, mag strips are EXTREMELY insecure and are trivial to clone, this would be massive mistake.
Jul
26
comment What is the funniest firewall rule set?
Wow, how is this not a real question?
Jul
26
asked What is the funniest firewall rule set?
Jul
24
comment Securely installing Wordpress in a subdirectory on a server
haha, security and wordpress in the same sentence. If you use wordpress your screwed and there is nothing you can do about it. I have looked at the code and i have reported vulnerabilities that project, their idea of secuirty is a joke.
Jul
24
answered Subversion and external collaborators: HTTPS vs. VPN
Jul
24
comment Preventing programmer from copying information
@PaulWaldman As long as the contractor is in the US you can sue him, there is nothing else you can do. (i like how you didn't post an answer :)
Jul
24
answered Card Reader and Software