163 reputation
7
bio website
location
age
visits member for 2 years, 3 months
seen Oct 23 at 7:59

It's musiKk (6D, 75, 73, 69, 4B, 6B). Not music, musik, musick, musikK, musikk, musickk, etc...

GitHub


Sep
30
comment Does gitolite provide an attack vector for the shellshock vulnerability?
@hamstar What is LC_FB used for? I tried to google it but no luck.
Sep
24
awarded  Autobiographer
Aug
13
comment Can my workplace view my Tor traffic?
This answer is a great reason why questions should be formulated neutrally. It's fine to advice someone of best practices but from a technical point of view half the answer is off-topic.
Jun
26
awarded  Commentator
Jun
26
comment Is sending plain passwords over SSL as part of a password update process bad?
Yes, that would be my favored solution. However, as of now it's unclear whether this is at all possible with Vaadin.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
It is pretty common to have to enter the new password multiple times because of the password policy—even if it is displayed on screen. UX-wise there should be no need to enter the old password multiple times. For the time being I'll reset the values just as you all suggest and in the long term I'll look into client side validation of the confirmation password and the password policy.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
The values are only part of the DOM that gets updated with AJAX. They never appear in a document that may be cached and the AJAX messages have caching disabled.
Jun
20
revised Is sending plain passwords over SSL as part of a password update process bad?
added 218 characters in body
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
You raise a valid point but I think your attack vector is impossible to mitigate for me. If the user enters all data, never submits the form and leaves the computer, the same situation occurs.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
Passwords are only part of AJAX messages. "view source" is not enough but observing the decrypted network traffic is (which is equally easy if you have access to the browser).
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
The passwords are never shown in the UI. All input fields are password fields that don't show characters. The passwords appear in AJAX messages only. You could even argue that having to enter the password multiple times increases risks of shoulder surfing because someone can observe the motions the user makes while type their password in multiple times. But I get your point.
Jun
19
comment Is sending plain passwords over SSL as part of a password update process bad?
@PwdRsch If the old password is correct but there is a typo in the confirmation field, the old password at least could stay, couldn't it?
Jun
19
asked Is sending plain passwords over SSL as part of a password update process bad?
Jun
18
awarded  Popular Question
Apr
24
awarded  Supporter
Mar
15
comment What is the benefit of the scope in OAuth2?
Quoting RFC 6749: "The [state] parameter SHOULD be used for preventing [CSRF] as described in Section 10.12." So I guess it is a security feature.
Aug
13
awarded  Scholar
Aug
13
accepted What is the benefit of the scope in OAuth2?
Aug
12
awarded  Editor
Aug
12
revised What is the benefit of the scope in OAuth2?
added 185 characters in body