113 reputation
5
bio website
location Finland
age 36
visits member for 2 years, 4 months
seen Sep 8 at 10:55

My daily work is a closed source PHP project but I'm really interested in open source projects and I know PHP, C/C++ and Perl 5 pretty well. I can do some Java, Python, x86 assembler (intel syntax) and some other programming languages, too. I'm currently running Ubuntu (workstation, home computer, laptop) and Cyanogenmod (phone) as my OS of choice. GPG: 563168EB


Sep
24
awarded  Autobiographer
Sep
8
comment OpenID Session Fixation with CSRF
For extra security, in step 2, send HMAC-SHA1 of your random value to the 3rd party server instead of sending the raw secret.
Sep
8
awarded  Scholar
Sep
8
accepted How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
Sep
4
revised How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
add links related to question, explain cookie forcing a bit
Sep
4
comment How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
I cannot redirect historical HTTP links to HTTPS because the historical HTTP content contains embedded IFRAMEs from domains that do not support HTTPS. Unfortunately, allowing mixed content cannot be decided by the server.
Sep
4
awarded  Editor
Sep
4
revised How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
add clarifications about the question
Sep
4
awarded  Student
Sep
3
asked How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
Aug
29
comment What is certificate pinning?
I'd claim that Convergence (or Perspectives) are not protocol extensions but a side channel for verifying that the host is using the same certificate when viewed from different locations around the globe and that this situation has around for a while. The core difference to other measures is that the host cannot affect this verification, unlike other cert pinning methods.
Mar
8
comment How reliable is a password strength checker?
Evaluating password quality is very hard. Your recommended checker gave "Very Strong"/"97%" for the password "Dog ate homework!"... Perhaps doing a google search for the password would be a better metric? That "password" gives 6000 hits so it probably is not that great: lmgtfy.com/?q=%22Dog+ate+homework!%22
Mar
8
comment XKCD #936: Short complex password, or long dictionary passphrase?
Example output of strings -n 10 /dev/urandom has stuff like t!AF|r)WlB, <^p!*P,gvv and -WAWkG;]%>(. Are you really claiming that you can remember any of those? The correct horse battery staple beer sounds like a winner to me and still has roughly the same entropy.
Jul
5
comment Do any security experts recommend bcrypt for password storage?
TL;DR: bcrypt is better than PBKDF2 because PBKDF2 can be better accelerated with GPUs. As such, PBKDF2 is easier to brute force offline with consumer hardware.
Jul
5
awarded  Supporter