Reputation
4,788
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
13 28
Newest
 Caucus
Impact
~130k people reached

  • 0 posts edited
  • 13 helpful flags
  • 195 votes cast
Jul
25
awarded  Caucus
Jun
17
answered Why did I see an insecure browser warning on my page?
Jun
15
comment Why did I see an insecure browser warning on my page?
@Joon Looking at the browser console (F12) for that page, I see a warning about an insecure image, not a link: Mixed Content: The page at 'https://secure.myshopper.oldmutual.co.za/shopper/FundEdit' was loaded over HTTPS, but requested an insecure image 'http://image.providesupport.com/online-presence-image/omtfsa?t=...'. This content should also be served over HTTPS.
Jun
11
comment Why did I see an insecure browser warning on my page?
I'm voting to close this question as off-topic because it is predicated on a mixed-content warning appearing under circumstances that do not appear to produce a mixed-content warning in practice. (Please add more information and/or an example that reproduces the warning. It is entirely possibly that links do produce mixed-content warnings, but only under specific circumstances. Without such information, this question cannot be answered.)
Jun
11
comment Why did I see an insecure browser warning on my page?
For example, I do not see any warnings on ondras.github.io/rot.js/hp, even though it links to http://doryen.eptalys.net/libtcod/.
Jun
3
revised Risks associated with HTTP content injection?
added 225 characters in body
Jun
3
answered Risks associated with HTTP content injection?
May
28
awarded  Good Answer
May
28
comment Is this way of encoding cryptographic hashes safe?
@Gilles An excellent point. I hope my edit does your comment justice?
May
28
revised Is this way of encoding cryptographic hashes safe?
added 726 characters in body
May
27
awarded  Nice Answer
May
27
comment Is this way of encoding cryptographic hashes safe?
@Polynomial I'm not suggesting that the extra digit is dropped; I agree that it does remain, and that that causees a problem. If the groups 03f and f43 are adjacent in the input (11 and 111 in the output), it is not possible to use the five character 11111 in the output to determine which group came first in the input. To restate a much shorter version of my previous example, the output from 03ff43 and f4303f are indistinguishable.
May
27
comment Is this way of encoding cryptographic hashes safe?
@Polynomial 03ff4303ff43...03ff439991 and f4303ff4303f...f4303f9991 both map to the same output value (1111111111...1111111CC1). There are lots of ways to modify the scheme so it doesn't cause collisions (I have suggested a few trivial ones), but as presented in the question, values can collide.
May
27
revised Is this way of encoding cryptographic hashes safe?
added 23 characters in body
May
27
comment Is this way of encoding cryptographic hashes safe?
If this were a bijective transformation, this would be perfectly correct; unfortunately, it is not. Three hex digits can express 4096 values, while two base62 digits can only express 3906 values, which sometimes requires the scheme to use three base62 digits. If this scheme had used leading zeroes, it could work (but I suppose that would defeat the entire point, mapping 3 digits onto three digits). Note the three-digit 11p and 12m output groups in the question's example.
May
27
answered Is this way of encoding cryptographic hashes safe?
May
18
comment Signing (HMAC) cookie identifier
Just to give an example, suppose the server's token generator is just a counter. If you have token 17, you can be pretty sure 16 and 18 are valid tokens, too. If an attacker needs a MAC of that token, though, then knowing that 16 is a valid token doesn't help (because the token is really 16 and HMAC(16, secret_key)).
May
8
answered HTTPS - Can server see details of client side certificate?
Apr
27
comment Is browsing http sites insecure?
@Mattias "And why do not sites like stackoverflow use https by default?" -- Stackoverflow.com: the road to SSL While that post is pretty old, and Stack Exchange does now optionally support HTTPS, my understanding is that its HTTPS support is this not perfect (i.e., things might break or fail to load correctly when using HTTPS).
Apr
23
comment External JS Security
Related (possibly a duplicate?): External cross domain include script