82 reputation
7
bio website
location
age
visits member for 1 year, 8 months
seen May 28 at 13:44

2h
awarded  Nice Question
Jun
25
awarded  Popular Question
Apr
21
awarded  Supporter
Apr
21
accepted Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?
Apr
21
comment Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?
Awesome. I thought so, but needed a second opinion before trying to sell that notion to my boss, and I couldn't find any such recommendation just by googling for it. Thanks much for the answer!
Apr
21
comment Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?
Ah. Good call. You are missing something, but only because I neglected to mention it. On the site we're maintaining, to protect against session hijacking/fixation, we store a nonce in the session and in a cookie when they go an SSL page. Every time they make an SSL request to change something on the server, we check the value of that cookie against the session value. So, sniffing a session id will only get them access to invoke non-SSL request handlers, not SSL request handlers. However, this mechanism won't protect against CSRF; only against session hijacking and/or fixation.
Apr
16
asked Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?
Mar
26
awarded  Teacher
Mar
25
answered Length of CSRF Token
Aug
15
comment Java SecureRandom doesn't block? How?
Simple, answers my question, backs up his claims. Thanks and +1. (That is +1 if I had enough reputation to upvote...)
Aug
15
accepted Java SecureRandom doesn't block? How?
Aug
14
awarded  Student
Aug
14
asked Java SecureRandom doesn't block? How?
Jan
11
awarded  Scholar
Jan
11
accepted Precedent for an in-house cardholder information server?
Dec
17
comment Precedent for an in-house cardholder information server?
Thanks for the answer. It's very enlightening. By "can't connect to anything in the CDE", I just meant that it can't fall under the definition of things "connected to the CDE" as mentioned very near the beginning of the section "Scope of Assessment for Compliance with PCI DSS Requirements". Also, we do have in mind to initiate connections from within the CDE and we definitely intend to run our design by our QSA. I do wish we could could find out how other people have done this before diving into it, though. Anyway, many thanks. :)
Dec
14
awarded  Editor
Dec
14
comment Precedent for an in-house cardholder information server?
AJ Henderson. Thanks for your input. Unfortunately our payment gateway won't provide all of the functionality necessary to do something like that, and we probably won't be switching any time soon. Whatever we do, we'll pretty much have to do in-house.
Dec
14
revised Precedent for an in-house cardholder information server?
deleted 173 characters in body
Dec
14
comment Precedent for an in-house cardholder information server?
Hello, Polynomial. Thanks for your input. I'll edit my post.