Web security researcher specialized in discovery and exploitation of HTML5 vulnerabilities. Author of a few recognized HTML5/UI redressing attack vectors.

Solid web application development background in creating secure e-commerce systems, intranet and social networking applications.

Contributes to various open-source projects and also develops his own open-source solutions (just google "ohloh koto").

Speaker at IT security conferences, OWASP and Tech Krakspot meetings.

Jun
14
awarded Nice Answer
Apr
1
awarded Yearling
Apr
1
awarded Yearling
Oct
25
awarded Informed
Sep
11
awarded Necromancer
Apr
1
awarded Autobiographer
Oct
19
answered How to exploit DRUPAL-SA-CORE-2012-003
Sep
12
comment CRIME - How to beat the BEAST successor?
@CodesInChaos that's my guess too. The PoC was created in a few hours, just to check if the idea is sound.
Sep
11
revised CRIME - How to beat the BEAST successor?
upgraded the algorithm
Sep
11
answered CRIME - How to beat the BEAST successor?
Sep
9
awarded Autobiographer
Aug
20
awarded Caucus
Jun
25
awarded Enlightened
Jun
19
comment Is it safe to use leakedin.org?
@JeremyThompson the pass->hash calculation was done client side, in Javascript. Then the server checked the submitted hash.
Jun
19
comment Why doesn't the same origin policy block get requests what contain arguments?
Minor correction: SOP prevents scripts from reading content from a location that the script is running at (i.e. the address of the web page that loads the script).
Jun
8
awarded Constituent
May
4
answered HTML payload rewriting?
Mar
13
answered Attacks against windows kiosk software
Feb
23
awarded Student
Feb
23
awarded Scholar
1 2 3 4 5