180 reputation
17
bio website
location
age
visits member for 2 years, 9 months
seen Apr 14 at 11:41

It's musiKk (6D, 75, 73, 69, 4B, 6B). Not music, musik, musick, musikK, musikk, musickk, etc...

Author of plyj

GitHub


Apr
14
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
@ArranSchlosberg Yes, they did it for, e.g., HEARTBLEED. I'm just wondering about this monthly update thing where not necessarily a compromise is involved, only mitigation.
Apr
14
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
Do the usual CAs sign new certificates for free? Otherwise this could be an expensive endeavor for smaller companies.
Apr
2
accepted Is sending plain passwords over SSL as part of a password update process bad?
Feb
25
comment Manually adding 's' to 'http'
@Iszi Yeah well, to be honest I didn't read your analogy. An analogy only gets you so far and usually raises more questions than it answers. My comment only refers to the (small) technical part.
Feb
25
comment Manually adding 's' to 'http'
There are other possible reasons for the red strike-through, e.g., wrong server name or expired certificate.
Feb
21
comment Avoid brute-force enumeration of customers in a SaaS application
Two reasons: User databases are distinct for security and legal reasons and logins are not guaranteed to be unique.
Feb
21
comment Avoid brute-force enumeration of customers in a SaaS application
1. I disagree that it is security by obscurity because we'd rely on a (shared) secret. 2. Customers are very weird. I heard of companies that didn't get—say—Volkswagen as a customer because they already had Mercedes (just an arbitrary example). I will propose your solution to management, though. Maybe this is really a solution to a non-existent problem.
Feb
19
asked Avoid brute-force enumeration of customers in a SaaS application
Feb
17
comment SAML 2.0 IdP metadata security
Couldn't someone perform MITM later if the metadata exchange is intercepted from the beginning?
Feb
11
comment What is a good way to authenticate a user to a smart phone?
On Android, face recognition is a convenience feature. You always have to provide an alternative unlocking mechanism.
Dec
22
awarded  Notable Question
Sep
30
comment Does gitolite provide an attack vector for the shellshock vulnerability?
@hamstar What is LC_FB used for? I tried to google it but no luck.
Sep
24
awarded  Autobiographer
Aug
13
comment Can my workplace view my Tor traffic?
This answer is a great reason why questions should be formulated neutrally. It's fine to advice someone of best practices but from a technical point of view half the answer is off-topic.
Jun
26
awarded  Commentator
Jun
26
comment Is sending plain passwords over SSL as part of a password update process bad?
Yes, that would be my favored solution. However, as of now it's unclear whether this is at all possible with Vaadin.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
It is pretty common to have to enter the new password multiple times because of the password policy—even if it is displayed on screen. UX-wise there should be no need to enter the old password multiple times. For the time being I'll reset the values just as you all suggest and in the long term I'll look into client side validation of the confirmation password and the password policy.
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
The values are only part of the DOM that gets updated with AJAX. They never appear in a document that may be cached and the AJAX messages have caching disabled.
Jun
20
revised Is sending plain passwords over SSL as part of a password update process bad?
added 218 characters in body
Jun
20
comment Is sending plain passwords over SSL as part of a password update process bad?
You raise a valid point but I think your attack vector is impossible to mitigate for me. If the user enters all data, never submits the form and leaves the computer, the same situation occurs.