meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 10 months |
| seen | May 2 at 6:38 | |
| stats | profile views | 36 |
|
Apr 12 |
comment |
Benefits of Content Security Policy Good answer. Was just about to say that CSP is really a defense-in-depth kind of technology, but you already did :) It's there to complement existing anti-XSS functionality, not replace it. |
|
Apr 9 |
awarded | Nice Answer |
|
Apr 3 |
comment |
Using SSL Certification in Multiple Locations You can get free SSL certrificates that work in all modern browsers from cert.startcom.org . They even allow you to specify an altName. companyname.com + whateverYouLike.companyname.com. |
|
Apr 1 |
comment |
SSL Encryption (for HTTPs) & Security vs Performance I presume one needs ECDSA server certificate and existing RSA-2048 certificate cannot be used? |
|
Mar 31 |
comment |
Why using random salts? Indeed, the salt does not need to be random, just unique. However, I'd say random salts are better as it makes for a simpler system because you don't have to worry about uniqueness. |
|
Mar 31 |
comment |
Why using random salts? It has to be unique enough to discourage making rainbow tables based on it. |
|
Mar 31 |
revised |
Why using random salts? added 1038 characters in body |
|
Mar 31 |
answered | Why using random salts? |
|
Mar 31 |
comment |
secure website against the ping of death attacks +1 for nice pictures :D |
|
Mar 13 |
comment |
Guarding against XSS when setting Cookies based on URI? Checking for authenticity and integrity enables you to know whether the cookie has been created by you and whether it has been modified. This way you can trust the cookie. nginx was not designed to be used in this way as you're clearly hitting its limitations. |
|
Mar 13 |
comment |
Guarding against XSS when setting Cookies based on URI? You're right. Authenticity and integrity of the cookies can be achieved by hmac(cookiePayload, secretKey) and then appending the output to the cookie. For each request you then have to check that the hash in the cookie is correct. |
|
Mar 13 |
answered | Guarding against XSS when setting Cookies based on URI? |
|
Mar 11 |
comment |
Report an email address being used by a phisher How can a website send login credentials to an email address with JavaScript? |
|
Mar 9 |
revised |
MySQL Access Control? edited tags |
|
Mar 9 |
comment |
MySQL Access Control? Stored procedures could be used to further improve security by allowing only the stored procedure to be executed, with user not having any other permissions (not even SELECT). Stored procedure must be defined as executing as a user that only has SELECT permission. You can also do this for write requests. I've heard many banks use this, but I don't know for sure. |
|
Mar 9 |
comment |
MySQL Access Control? en.wikipedia.org/wiki/Defense_in_depth_%28computing%29 |
|
Mar 9 |
accepted | How did Evernote detect the security breach? |
|
Mar 8 |
comment |
How did Evernote detect the security breach? DLP = Data Loss Prevention; en.wikipedia.org/wiki/Data_loss_prevention_software |
|
Mar 8 |
asked | How did Evernote detect the security breach? |
|
Mar 6 |
comment |
Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible? Function AES_ENCRYPT() in MySQL is insecure because it operates in ECB block mode. Furthermore, it doesn't assure authenticity. |
