AJ Henderson

10,952 reputation

1834

bio	website
	location	Troy, NY
	age	28
visits	member for	9 months
	seen	2 hours ago
stats	profile views	317

	10,952 reputation	bio	website		visits	member for	9 months
1834 badges		location	Troy, NY		seen	2 hours ago

summary answers questions tags badges favorites bounties reputation activity

1,323 Actions

suggestions reviews revisions comments badges posts accepts all

1d	comment	Does providing OAuth for mobile apps pose a security threat? @Vanuan - oh, OAuth doesn't really help with that at all then. The app would be the client and OAuth isn't designed to prove anything about the client. Unfortunately, there isn't really anything you can do that can't fairly easily be copied. You could use a client certificate in the application and use a two way SSL, but someone could hack out that certificate. When someone has complete control of the device, you pretty much have to trust them or not, but there is no way to ensure they behave well unless you do everything server side to disallow any bad things.
2d	comment	Does providing OAuth for mobile apps pose a security threat? @Vanuan - It deals with the immediate problem (as secret keys to communicate with the oauth service providers are protected) but it still requires a means of protecting the app from trying to not use your server. That's a much simpler problem though as you can use SSL and ensure that it connects to the appropriate server (with the appropriate private key). Someone could still hack the application to use another server's certificate, but there is no way to prevent that.
May 22	comment	Why standards organizations give so short protection times for 128 bit encryption? It is worth pointing out that quantum computers don't help much against symmetric encryption. It is primarily asymmetric encryption which is weakened by quantum computing due to the ability to factor large semi-primes.
May 22	answered	Does providing OAuth for mobile apps pose a security threat?
May 22	reviewed	Close Force clients to use proxy
May 22	answered	Store username in cookie for a web site
May 22	answered	Becoming a malware analyst?
May 22	answered	Storing config securely in a semi trusted shared hosting environment
May 21	comment	Secure way to establish PHP database connections @Artfulrobot If they can't impersonate your scripts, then they can't access the configuration either.
May 21	reviewed	Leave Open How to make a site vulnerable to SQLi?
May 21	comment	Certificate usage Can you include some details about your broader goals? This doesn't really seem to have enough information to ensure that the best approach is being taken. What do you mean by a middle ware solution answering certificate and ask credentials for SSO? You don't need anything in particular to make client certificates because they only need to be trusted by the service (or services) they are used to authenticate against. The rest of your question is too vague to answer though.
May 21	comment	How to make a site vulnerable to SQLi? @JacobKudria - In order to prevent SQL Injection, you have to sanitize input to make sure that it isn't an unexpected value. This varies based on the data. If it's a number, you make sure it's only numbers. Regardless you want to make sure that it can't contain any SQL keywords in a way they could be used and preferably want to use parametrized SQL so that even if SQL keywords were present, they wouldn't be executed. There are many ways that you can validate form input and no one solution is perfect in all cases.
May 21	comment	Secure way to establish PHP database connections @artfulrobot - right, but if they can upload their own scripts, then you are sunk no matter what you do as their scripts can impersonate your valid scripts and get the same object. The only alternative would be to do a nested SOAP type service for all the data and have a SOAP based DAL that is isolated from the general web.
May 21	answered	How to make a site vulnerable to SQLi?
May 21	reviewed	No Action Needed How to make a site vulnerable to SQLi?
May 21	answered	Ways to look for changes on a PC
May 21	answered	Secure way to establish PHP database connections
May 21	answered	If a hacker is on the same Wifi Network as I am, what can he do?
May 21	comment	What about AD2P vulnerability? Any ideas on why this post got downvoted?
May 21	comment	Is there a dictionary of visibly similar Unicode characters for Spam processing? If you are specifically looking for English language filtering, why do you need a dictionary at all. Isn't the presence of non-latin characters evidence of SPAM by itself?