Reputation
302
Top tag
Next privilege 500 Rep.
Access review queues
Badges
1 8
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 5 votes cast
1h
awarded  Good Question
Jan
18
comment Fake users in database for compromise detection
Clarified question - I did mean an end user, not the db user. Regarding privilege escalation, I don't think that is a worry (in the website user context). If it is, then I've got bigger issues :)
Jan
18
comment Fake users in database for compromise detection
Clarified question - I did mean a end user, not the db user. I don't think this would add any issues - any user can create an account on my site and in theory, my fake user would be identical so not to look fake.
Jan
18
revised Fake users in database for compromise detection
Clarification to 'users' and 'database'. Looks like some think I mean the db user itself. I meant the website end user.
Jan
18
awarded  Popular Question
Jan
18
awarded  Nice Question
Jan
18
awarded  Curious
Jan
17
asked Fake users in database for compromise detection
Oct
20
comment Using HMAC when sending data through an untrusted server
Let us continue this discussion in chat‌​.
Oct
20
comment Using HMAC when sending data through an untrusted server
I see, I don't think that would be suitable for the pop up then as the user isn't going to use the same machine, browser etc each time and I can't see that the user would move it from place to place. However, that sounds like it would be great for a Android/ios app. Thank you.
Oct
19
awarded  Commentator
Oct
19
comment Using HMAC when sending data through an untrusted server
@atk I am happy to use digital signatures if that is an option, but doesn't it need a certificate? Wouldn't it make it more complicated than using a PIN? I didn't 'choose' hmac, it was the only way I know.
Oct
19
revised Using HMAC when sending data through an untrusted server
It was not clear that FE didn't do the initial hashing. FE never sees the PIN unhashed.
Oct
19
comment Using HMAC when sending data through an untrusted server
Edited question to show preferable to see data and not have it encrypted.
Oct
19
accepted Is it any more secure to use a HTML form instead of a javascript popup?
Oct
19
revised Using HMAC when sending data through an untrusted server
added 88 characters in body
Oct
19
comment Using HMAC when sending data through an untrusted server
@atk Would you mind elaborating? AFAIK, digital signatures requires a certificate and that's not an option. Isn't the process pretty similar, but encrypts the data too? If so, that isn't an option as I would still like the FE to do some basic validation of the data before passing through.
Oct
19
asked Using HMAC when sending data through an untrusted server
Oct
18
comment Is it any more secure to use a HTML form instead of a javascript popup?
Thank you - it's what I thought (and was hoping). I only really mentioned HTTPS to keep mitm concerns out of the picture.
Oct
18
asked Is it any more secure to use a HTML form instead of a javascript popup?