meta user
network profile
| bio | website | paralint.com |
|---|---|---|
| location | Montreal, Canada | |
| age | ||
| visits | member for | 2 years, 3 months |
| seen | Apr 13 at 15:31 | |
| stats | profile views | 49 |
I like smart people who get things done. I do my best everyday to be one of them.
I code mostly in C++, Python, Java and... whatever comes my way. I also like to understand a problem down to its roots, a process also known as debugging.
|
Feb 25 |
awarded | Popular Question |
|
Feb 4 |
awarded | Custodian |
|
Feb 4 |
reviewed | Excellent Future proof encryption possible in theory? |
|
Feb 4 |
reviewed | Excellent Is it preferable to perform encryption using database functions or code? |
|
Feb 4 |
reviewed | Excellent Is it useful to determine the name of the server software while doing a penetration test? |
|
Feb 4 |
comment |
Picking an encryption algorithm for auth tokens passed via AJAX Should you decide to do cryptography in the browser, you might want to look at the Stanford Javascript Crypto Library. |
|
Feb 4 |
comment |
Picking an encryption algorithm for auth tokens passed via AJAX Beware : manipulating cookies with javascript will prevent you from using http only cookies, which increases the risk associated with cross-site scripting (XSS). Complexity is the ennemy of security. |
|
Feb 1 |
revised |
Erasing Truecrypt keyfile(s) after volume has been mounted Self-nitpicking |
|
Feb 1 |
awarded | Informed |
|
Feb 1 |
answered | Erasing Truecrypt keyfile(s) after volume has been mounted |
|
Jan 26 |
awarded | Yearling |
|
Nov 29 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? Very true, @mehaase. I have updated my answer below to mention its limits. |
|
Nov 28 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? This prevents an attacker from getting a valid session cookie, maybe by starting a registration process, and forcing you to authenticate using that session cookie. The attacker does not have the password, but is valid session cookie is now authenticated. Asking the old password when you change your original password prevents further damages. |
|
Nov 28 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? I don't know about a formal guidance, but a server could add a something like a version, like a counter or a timestamp, to the authentication cookie. So when a request comes in, the server would : 1. Decrypt the cookie or verify that it was not tampered with 1. Read the password version or timestamp that was valid when the cookie was generated 1. If the password version or timestamp is older, prompt for authentication again. This might be harder to do in other environments. For example, a Kerberos ticket held by an attacker will stay valid after you reset your password. On the web, GMail has t |
|
Nov 28 |
comment |
Is there formal guidance that requires all sessions to be logged off when a user changes their password? Your password is used when you authenticate only. Cookies take it from threre. Changing your password does not change your cookies. You can clear your cookies, but the attacker who logged in with your old password won't :) |
|
Nov 23 |
comment |
Public key Infrastructure @Zzz you have the answer, post it ! |
|
Nov 6 |
answered | Attacking an office printer? |
|
Aug 21 |
awarded | Constituent |
|
Aug 16 |
awarded | Caucus |
|
Jul 30 |
comment |
Can my company see what HTTPS sites I went to? Yes, indeed ! You would have to compare fingerprint and such wich is very very unlikely to happen. |
