231 reputation
28
bio website
location
age
visits member for 1 year, 11 months
seen Oct 31 '13 at 7:11

Sep
14
comment In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
Oooh, I especially like the second point. Has anyone ever heard of PGP being used for multi-party mailing lists?
Sep
13
asked In PGP, why not just encrypt message with recipient's public key? Why the meta-encryption?
Sep
10
comment Why are CSRF tokens necessary?
@Gumbo that's a great point.
Sep
10
comment Why are CSRF tokens necessary?
I think it's really fantastic how accessible information about security is becoming. Thanks!
Sep
10
awarded  Scholar
Sep
10
accepted Why are CSRF tokens necessary?
Sep
10
comment Why are CSRF tokens necessary?
Well that makes sense then. There really isn't any additional privacy leak to sending same-site referrers, though, and that's really all that's called for here. I believe the browsers that offer a way to disable referer transmission only allow disabling it for external link clicks. Of course there're extensions to both big browsers that disable it completely. But yeah, obviously there'd be a reasonably explanatory error message.
Sep
10
comment Why are CSRF tokens necessary?
I don't think it actually would break BC, if you read the post carefully. Is "nonce" synonymous with "CSRF token"?
Sep
10
comment Why are CSRF tokens necessary?
But what I don't understand is how a replay attack is an attack at all. Seems more like an innocent accident or a bug or a mishap. Also, isn't the risk of that mitigated by disabling / "greying out" the button on it's click event? I read a post about that one time, I think it was on codinghorror. I'd also redirect after the POST receiver script got hit. Finally, how would you verify the nonce when you received it back?
Sep
10
comment Why are CSRF tokens necessary?
I don't believe that the HTTP spec requires referrer transmission. But if one assumes that their users have internal referrer transmission enabled, I assume just verifying that would do the trick too, wouldn't it?
Sep
10
awarded  Student
Sep
9
asked Why are CSRF tokens necessary?