215 reputation
29
bio website michael.mior.ca
location Waterloo, Canada
age
visits member for 1 year, 11 months
seen Jul 18 at 21:23

I received my Masters from the University of Toronto researching database scalability in the cloud. I spent now working as a Web developer at Bunch working on frontend HTML/CSS/JS, backend PHP/Python/MySQL, and iPhone app.

I'm currently a PhD student in the database group at the University of Waterloo.


Feb
19
awarded  Yearling
Oct
7
accepted OAuth access token vs session key
Oct
3
awarded  Notable Question
Apr
13
awarded  Popular Question
Dec
21
awarded  Editor
Dec
21
revised How can I explain SQL injection without technical jargon?
fixed name of exploit
Dec
21
comment How can I explain SQL injection without technical jargon?
I don't really see the connection here.
Dec
21
comment How can I explain SQL injection without technical jargon?
While I find this rather amusing and the principle is accurate. This falls short in the sense that the person who wrote the words for the cake had the authority to issue somewhat arbitrary commands if desired. This isn't the case with SQL injection.
Dec
21
suggested suggested edit on How can I explain SQL injection without technical jargon?
Dec
21
awarded  Critic
Dec
21
comment How can I explain SQL injection without technical jargon?
A more accurate analogy would be if the your boss left the account number blank, because he trusted you to fill it in. And then you filled in the account number with additional instructions.
Sep
16
awarded  Commentator
Sep
16
comment OAuth access token vs session key
I'm not dealing with a browser-based client, so CSRF doesn't come into play. Seems like there's an equal vulnerability when it comes to session hijacking/OAuth token hijacking.
Sep
16
comment Can't explain data from side channel attack attempt
Thanks for pointing out the bug. I translated from another code based that used some boolean macros and obviously made a typo there. I agree with what you have in your last paragraph. I was just expecting the possibility of some difference due to the fact that the character comparisons are no longer performed after the length of the second string exceeds that of the first.
Sep
15
asked OAuth access token vs session key
Sep
14
awarded  Scholar
Sep
14
comment Can't explain data from side channel attack attempt
Thanks for your point about array access times. I'm not sure what you mean when you say it's not "linear." That seems to imply that array access is O(n), which of course isn't the case. Anyway, accepting this answer because it explains a lot :)
Sep
14
accepted Can't explain data from side channel attack attempt
Sep
14
comment Can't explain data from side channel attack attempt
That was my assumption, which was why I tried this exercise. I'm not sure what you mean about strlen being a black box. The implementation is easily looked up. But I agree it's much easier to reason using the simple loop in your answer. As for the loop overhead, since it's constant, I assume it doesn't really matter. Removing it would certainly make the measurements more accurate, but I don't think it's necessary for correctness.
Sep
13
comment Where to put private files on a shared web server
Ah, I see what you mean. If you have some way of reading this file from your code, that's quite possibly safer. Although you presumably have no knowledge of where this file is stored, so who knows?