Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
6
Impact
~697 people reached

Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
Please come see the library for yourself it uses a uid generated directly from node.js's crypto library, base64'ed for the session id. The signing uses node.js's crypto library also to sign using Hmac-sha256 so unless node.js crypto library is broken this library is signing with node.js's core. If node.js's crypto library is broken please let them know.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
This is a library, not an application it only deals with the session, the store connects an app to the database so the store has to deal with sqli mitigation. The biggest threat at this point for this module is tampering. Rate-limiting is for the developer to decide in the main application. How is tampering irrelevant for blocking guessing valid sessionid's? If they don't know the signature they can't even begin to guess session id's to steal.
Jun
21
awarded  Citizen Patrol
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
What would you suggest to avoid session cookie tampering then?
Mar
14
revised Why do mobile apps have fine-grained permissions while desktop apps don't?
fixed some grammar
Mar
14
suggested approved edit on Why do mobile apps have fine-grained permissions while desktop apps don't?
Mar
5
revised Prevent cold boot attack on running laptop by overwriting ram
adjusted wording to make it sound less like a request to write a program
Mar
5
suggested approved edit on Prevent cold boot attack on running laptop by overwriting ram
Mar
22
comment What are these long www bitnik URL?
I missed the 242 243 difference.
Mar
21
awarded  Critic
Mar
21
awarded  Editor
Mar
21
revised What are these long www bitnik URL?
added some information
Mar
21
comment What are these long www bitnik URL?
as a side note you are digging the same domain twice in your script
Mar
21
comment What are these long www bitnik URL?
that's a nice way to beat the crap out of the public dns server.
Mar
21
comment What are these long www bitnik URL?
try finding all of the subdomains of google, or facebook, or anything you can't there's no way to know that you have them all without either beating the crap out of their dns server or a public dns server I didn't mean that those servers wouldn't be visible...
Mar
20
awarded  Teacher
Mar
20
answered What are the security features of JRE 8?
Mar
20
comment What are these long www bitnik URL?
yeah I don't surf those sites often so I wanted to cover the possibilities.
Mar
20
answered What are these long www bitnik URL?
Jan
24
awarded  Supporter