461 reputation
1513
bio website hileco.com
location
age
visits member for 2 years, 9 months
seen Jul 28 at 12:38

Java consultant for SOA projects. Anything i put on StackOverflow is my own opinion.

See also my Github & check out tools I use, because tools make life easier.


Jul
28
awarded  Caucus
Jul
28
awarded  Constituent
Jul
28
comment Why refresh CSRF token per form request?
An attacker using XSS can get access to new tokens, this is what the whole question is about. See also the comments on security.stackexchange.com/a/22904/15195
Jul
22
comment Why refresh CSRF token per form request?
Okay, but i have to note in the examples and paper you've listed a theoretical attacker could measure the CPU clock time very precisely. The machine was under no other load, and many languages use precalculated hashcodes for string comparison before performing a character by character check.
Apr
30
awarded  Good Question
Apr
13
awarded  Famous Question
Nov
24
awarded  Yearling
Sep
24
awarded  Autobiographer
Aug
27
awarded  Informed
Aug
22
accepted Why refresh CSRF token per form request?
Aug
10
awarded  Citizen Patrol
Aug
8
comment How is Truecrypt any safer than just password-protection?
@erwinmatijsen Theres some real life examples on TrueCrypt's wikipedia entry on organizations trying this guessing, though it doesn't say with what computing power the FBI's was using, it states they tried a dictionary attack ( ; guessing ) for 12 months, they then gave up.
Aug
7
revised Why do people trust PlayFramework2 dependency management?
deleted 35 characters in body
Aug
7
answered Why do people trust PlayFramework2 dependency management?
Jul
28
answered XSS in HOST header
Jun
8
comment Are legal notices in a login banner legally significant in terms of computer misuse?
Im not a lawyer but when I went to uni my networking teacher said not to put welcoming MOTDs on routers/switches, as that will be used in court, if some guy gets into it and your software tells him welcome & have fun that's what he'll do
May
15
revised Why refresh CSRF token per form request?
More information on the question of why to do it
Jan
10
comment Using skype for an attack
+1 Skype works peer to peer and in my experience I've always been able to see the hostname the ISP assigned to the person on the other end. ( For group calls you can see that of the host of the group call. )
Nov
26
awarded  Notable Question
Oct
20
awarded  Yearling