network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 11 months |
| seen | Apr 22 at 15:14 | |
| stats | profile views | 0 |
|
Jan 6 |
comment |
Is OpenSSL secure enough? Not all security errors in SSL implementations are caused by buffer overflows: side-channel attacks on cryptographic functions (which might be a lot more difficult to avoid in pure Java code, especially timing attacks) and logical errors in the protocol implementation are more likely to cause security issues than the fact that the library is not implemented in a memory-safe language. |
|
Jul 30 |
comment |
How to secure passwords when site is opensource I personally prefer using unique salts and a static salt. In the event that your database is leaked but the place (config file or such) in which you store your static is not, attackers still won't be able to achieve anything. It's a slight improvement, but an improvement nonetheless. |
|
Jun 30 |
comment |
How to defend against invalid UTF7/8 that hides a <script> tag? Exactly. I would like to add that, even if you would have a perfect XSS-detector, you shouldn't be filtering input anyway. What if, say, a user wants to use a < somewhere or demonstrate some Javascript? Instead you should see text and HTML as two different things; and whenever you want to include some form of text into your page, you'll have to 'convert' it to HTML (by using an escape function that only accepts UTF-8) first. |
|
Jun 8 |
comment |
An alternative to traditional passwords: is there some merit to this idea? Additionally, the possibility of two people choosing the same sentence shouldn't be any problem if you salt the hashes with a unique random string for each user, so that each user has a unique hash. This is already good practice for regular passwords, so I didn't mention it. |
|
Jun 8 |
comment |
An alternative to traditional passwords: is there some merit to this idea? Thanks, those are some good points. However, I don't think the dictionary is such a problem: the Oxford dictionary contains about 170000 words, which would translate to a word list of about 1MB (you can reduce its size by e.g. using a smaller dictionary of more common words and not including short words). That's not very difficult to do lookups in at the server-side. If someone where to use only five words (without anything added to make it into a valid sentence) you'd still have a massive amount of possible combinations. |
