2,007 reputation
414
bio website
location
age
visits member for 2 years
seen 2 hours ago

just a guy


Jul
19
answered Want to build a password manager using OpenPGP.js
Jul
19
comment Want to build a password manager using OpenPGP.js
@David the use cases of browser crypto that are in the matasano article are not consistent with a what a password manager does. I've read Thomas Ptacek (the author) saying ~"no matter which you choose, you should be using A password manager~" many times...
Jun
8
revised If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?
added 198 characters in body
Jun
8
answered If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?
May
22
awarded  Revival
May
3
comment What is the most credible timestamp I can create for a digital file?
@Keith Thompson nothing however when I posted this the question changed several times after.
May
2
comment What is the most credible timestamp I can create for a digital file?
Just a thought. Sign the timestamp and store it somewhere.
Apr
16
comment What's wrong with my own authentication scheme?
Of course it wasn't exhaustive. I had actually already upvoted you. I'm not criticizing your answer just explaining why it can't possible be exhaustive (garbage in garbage out).
Apr
16
comment What's wrong with my own authentication scheme?
The most pressing information is the "other flaws" clause. CSRF is a no-brainer here but your own auth scheme is far bigger than just 3 posts that you have to worry about. How you create your Session, if you generate a new one, how you manage the session, what cookie flags you set, there is much more than three post requests to worry about
Apr
15
comment Understanding Session Fixation Vulnerability
Oftentimes, sites give non-authenticated users SessionIDs
Apr
10
comment Does this reflected XSS vulnerability pose any real threat?
I'm saying that there is nothing "cross site" about the code you posted (you said this meaning alert(1) to me). that input field could be used for reflected xss.
Apr
10
comment Does this reflected XSS vulnerability pose any real threat?
This isn't a XSS that you posted. It's how people test for XSS (oftentimes). A malicious XSS will attempt to download malicious js files, exfiltrate data, download malicious jar files, or do some kind of other malicious activity where some other evil domain is accessed
Mar
26
comment MySQL authentication, how to pad the 20-byte salt
Hm . It's odd because my code to regenerate the has still doesn't work sha1(pw) ^ sha1( sha1(salt).sha1(sha1(pw))) should be correct.
Mar
26
asked MySQL authentication, how to pad the 20-byte salt
Mar
24
comment Username Enumeration as a Threat
You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account.
Mar
24
comment session security in php
It all depends is the problem. Your question has no specifics. No attempt to say what you're trying to prevent. IP might be overkill if you're expecting people to move around...bad UX to make them relogin all the time if it's a mobile app. Referrer can be spoofed...it isn't really adding anything. It all depends....
Mar
24
comment session security in php
I didn't downvote you, but don't you want to check to see if the session is even valid? 5 seconds? Are you expecting rapid clicking?
Mar
23
comment Is there a decentralized version of LastPass?
In the link he doesn't say it is secure, he says audit it yourself and come to a conclusion on your own. There is a fundamental difference in the architecture of lastpass and something like lavabit, though. thoughtcrime.org/blog/lavabit-critique
Mar
23
comment Is there a decentralized version of LastPass?
To add to the conversation, here is the CEO of LastPass writing about LastPass here. security.stackexchange.com/questions/15822/…
Mar
20
comment What needs to be focused on when hardening a LAMP stack?
I want to add. Make sure your stack is only a LAMP stack. If you install a bundle of software that is LAMP, it could have things you might not want in it. PHPMYADMIN, FTP, WEBDAV. XAMPP has these (even though XAMPP is supposed to be used as a development platform).