173 reputation
17
bio website
location
age
visits member for 2 years, 8 months
seen 18 hours ago

It's musiKk (6D, 75, 73, 69, 4B, 6B). Not music, musik, musick, musikK, musikk, musickk, etc...

Author of plyj

GitHub


Feb
25
comment Manually adding 's' to 'http'
@Iszi Yeah well, to be honest I didn't read your analogy. An analogy only gets you so far and usually raises more questions than it answers. My comment only refers to the (small) technical part.
Feb
25
comment Manually adding 's' to 'http'
There are other possible reasons for the red strike-through, e.g., wrong server name or expired certificate.
Feb
21
comment Avoid brute-force enumeration of customers in a SaaS application
Two reasons: User databases are distinct for security and legal reasons and logins are not guaranteed to be unique.
Feb
21
comment Avoid brute-force enumeration of customers in a SaaS application
1. I disagree that it is security by obscurity because we'd rely on a (shared) secret. 2. Customers are very weird. I heard of companies that didn't get—say—Volkswagen as a customer because they already had Mercedes (just an arbitrary example). I will propose your solution to management, though. Maybe this is really a solution to a non-existent problem.
Feb
19
asked Avoid brute-force enumeration of customers in a SaaS application
Feb
17
comment SAML 2.0 IdP metadata security
Couldn't someone perform MITM later if the metadata exchange is intercepted from the beginning?
Feb
11
comment What is a good way to authenticate a user to a smart phone?
On Android, face recognition is a convenience feature. You always have to provide an alternative unlocking mechanism.
Dec
22
awarded  Notable Question
Sep
30
comment Does gitolite provide an attack vector for the shellshock vulnerability?
@hamstar What is LC_FB used for? I tried to google it but no luck.
Sep
24
awarded  Autobiographer
Aug
13
comment Can my workplace view my Tor traffic?
This answer is a great reason why questions should be formulated neutrally. It's fine to advice someone of best practices but from a technical point of view half the answer is off-topic.
Jun
26
awarded  Commentator
Jun
26
comment Is sending plain passwords over SSL as part of a password update process bad?
Yes, that would be my favored solution. However, as of now it's unclear whether this is at all possible with Vaadin.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
It is pretty common to have to enter the new password multiple times because of the password policy—even if it is displayed on screen. UX-wise there should be no need to enter the old password multiple times. For the time being I'll reset the values just as you all suggest and in the long term I'll look into client side validation of the confirmation password and the password policy.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
The values are only part of the DOM that gets updated with AJAX. They never appear in a document that may be cached and the AJAX messages have caching disabled.
Jun
20
revised Is sending plain passwords over SSL as part of a password update process bad?
added 218 characters in body
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
You raise a valid point but I think your attack vector is impossible to mitigate for me. If the user enters all data, never submits the form and leaves the computer, the same situation occurs.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
Passwords are only part of AJAX messages. "view source" is not enough but observing the decrypted network traffic is (which is equally easy if you have access to the browser).
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
The passwords are never shown in the UI. All input fields are password fields that don't show characters. The passwords appear in AJAX messages only. You could even argue that having to enter the password multiple times increases risks of shoulder surfing because someone can observe the motions the user makes while type their password in multiple times. But I get your point.
Jun
19
comment Is sending plain passwords over SSL as part of a password update process bad?
@PwdRsch If the old password is correct but there is a typo in the confirmation field, the old password at least could stay, couldn't it?