1,958 reputation
413
bio website
location
age
visits member for 1 year, 8 months
seen 1 hour ago

just a guy


2d
comment What's wrong with my own authentication scheme?
Of course it wasn't exhaustive. I had actually already upvoted you. I'm not criticizing your answer just explaining why it can't possible be exhaustive (garbage in garbage out).
2d
comment What's wrong with my own authentication scheme?
The most pressing information is the "other flaws" clause. CSRF is a no-brainer here but your own auth scheme is far bigger than just 3 posts that you have to worry about. How you create your Session, if you generate a new one, how you manage the session, what cookie flags you set, there is much more than three post requests to worry about
Apr
15
comment Understanding Session Fixation Vulnerability
Oftentimes, sites give non-authenticated users SessionIDs
Apr
10
comment Does this reflected XSS vulnerability pose any real threat?
I'm saying that there is nothing "cross site" about the code you posted (you said this meaning alert(1) to me). that input field could be used for reflected xss.
Apr
10
comment Does this reflected XSS vulnerability pose any real threat?
This isn't a XSS that you posted. It's how people test for XSS (oftentimes). A malicious XSS will attempt to download malicious js files, exfiltrate data, download malicious jar files, or do some kind of other malicious activity where some other evil domain is accessed
Mar
26
comment MySQL authentication, how to pad the 20-byte salt
Hm . It's odd because my code to regenerate the has still doesn't work sha1(pw) ^ sha1( sha1(salt).sha1(sha1(pw))) should be correct.
Mar
26
asked MySQL authentication, how to pad the 20-byte salt
Mar
24
comment Username Enumeration as a Threat
You can pick 5 passwords to try for each account you enumerate. Once you are required to enter a captcha, try a new account.
Mar
24
comment session security in php
It all depends is the problem. Your question has no specifics. No attempt to say what you're trying to prevent. IP might be overkill if you're expecting people to move around...bad UX to make them relogin all the time if it's a mobile app. Referrer can be spoofed...it isn't really adding anything. It all depends....
Mar
24
comment session security in php
I didn't downvote you, but don't you want to check to see if the session is even valid? 5 seconds? Are you expecting rapid clicking?
Mar
23
comment Is there a decentralized version of LastPass?
In the link he doesn't say it is secure, he says audit it yourself and come to a conclusion on your own. There is a fundamental difference in the architecture of lastpass and something like lavabit, though. thoughtcrime.org/blog/lavabit-critique
Mar
23
comment Is there a decentralized version of LastPass?
To add to the conversation, here is the CEO of LastPass writing about LastPass here. security.stackexchange.com/questions/15822/…
Mar
20
comment What needs to be focused on when hardening a LAMP stack?
I want to add. Make sure your stack is only a LAMP stack. If you install a bundle of software that is LAMP, it could have things you might not want in it. PHPMYADMIN, FTP, WEBDAV. XAMPP has these (even though XAMPP is supposed to be used as a development platform).
Mar
18
comment Why is client-side hashing of a password so uncommon?
A lot of people question whether any extra security is gained with this practice. One thing it does do is reduce risk. If you always hash or encrypt (I've seen steam/valve encrypt with a public key and I bet they are not decrypting) there is no chance of you ever having an embarrassing plaintext breech. No...it isn't any more secure but it isn't pointless
Mar
17
awarded  Nice Answer
Mar
17
comment Setup of Kali Linux for reverse shell connections over the internet
Why a reverse shell? Just open a port that connecting to gives a shell. Your problem indicates that you can already execute code remotely. Set up a VPS if you NEED a reverse shell that is internet facing.
Mar
16
revised Does Facebook store plain-text passwords?
added 6 characters in body
Mar
16
answered Does Facebook store plain-text passwords?
Mar
9
comment How do I find out what kind of encryption this is and how to decode it?
Doesn't look like encrypted text. Looks like base64 (which is simply a form of encoding). If it is truly encrypted with a good algorithm you shouldn't be able to tell what it was encrypted with. You MIGHT be able to make a few educated guessed based on block size, though...but that's besides the point.
Mar
4
comment What is the distinguishing point between a script kiddie and a hacker?
No I wasn't. As far as I can tell, I posted this before you posted that on quora.