173 reputation
6
bio website
location Denmark
age 26
visits member for 1 years, 8 months
seen Jan 13 at 17:12

I am a fulltime webdeveloper, working with PHP and MySQL.


Jan
23
awarded  Critic
Jan
23
comment is it easier to get the original password if you have multiple hashes of it?
If the three types of hashes differ in strength, then the weakest hash algorithm will prove easier to crack, no matter the strength of the password.
Dec
10
comment How are CVE identifiers assigned and managed?
Does this site help you out? cve.mitre.org/cve/identifiers/build.html
Dec
4
comment Dealing with a (possible) virus on both MacOSX and iOS
If your iPhone starts acting weird, when it gets back on the WIFI, you should check your router, and see if it's been compromised, or any DNS rules have been added.
Dec
3
comment Dealing with a (possible) virus on both MacOSX and iOS
Does your iPhone also redirect, if it's not connected to WIFI?
Dec
3
answered Dealing with a (possible) virus on both MacOSX and iOS
Nov
13
comment Creating Secure PHP Sessions
What if the session expires and someone has the random string from the cookie? Blocking out by IP is not secure, and to my knowledge, neither is the cookie.
Nov
5
comment Infection I can't shut down, disguises process as scvhost.exe
Trusting AV is like trusting that you can't die in a car crash, just because you wear a seat belt
Nov
2
comment When using AES and CBC, is it necessary to keep the IV secret?
@Polynomial Thank you for the clarification.
Nov
2
comment When using AES and CBC, is it necessary to keep the IV secret?
@D.W. What does truly random mean?
Nov
1
comment Iframe javascript Keylogger
My point was, don't think that because you're using this technique, you're home free, and don't have to care about XSS vulnerabilities.
Oct
31
comment Iframe javascript Keylogger
But frame busting is not reliable, if you have a XSS vulnerability, as you can, in IE8 and Chrome, use the XSS filter to destroy it.
Sep
27
awarded  Scholar
Sep
27
accepted Trusted device web application
Sep
27
comment Trusted device web application
Thank you for this. Your post got me thinking, and I think I've found a way to make it all happend, safely. :)
Sep
26
awarded  Commentator
Sep
26
comment Trusted device web application
I think you're overcomplicating what I asked. "Trusted device" doesn't mean he doesn't have to log in. He will still have to log in using password + username, however, he can ONLY log in from given machine.
Sep
26
asked Trusted device web application
Sep
24
comment Why do some sites prevent users from reusing their old passwords?
@Joren But how long would it take to bruteforce, them if you actually dump the database, and there's maybe, 20 passwords for this one user? Is this not an added vector of attack?
Sep
24
comment Why do some sites prevent users from reusing their old passwords?
Wouldn't that mean, that the system would have to keep a log of every single password, ever used by this one user? Doesn't that increase the chance that he's using passwords he used before, and makes this a high value target, to obtain and crack the passwords? Say we know user X uses this app. Hack this app, obtain a huge list of passwords, for this one user, crack them, and try them?