130 reputation
4
bio website
location
age
visits member for 1 year, 10 months
seen Aug 28 at 9:47

Aug
28
comment HTTP Basic auth password storage more secure than Digest auth
The RFC is incorrect in its first paragraph. In the Basic auth, the username and password are not transmitted in clear text. They are transmitted in an encoded string.
Aug
27
comment HTTP Basic auth password storage more secure than Digest auth
As I understand it, Digest does not imply storing the passwords on the server. The server can store hashes (non-reversible).
Aug
27
awarded  Editor
Aug
27
revised Why is “www.” considered unsafe in this HTTPS URL?
Undoing the wrong "correction", "behaviour" is perfectly correct, respect the original author
Aug
27
suggested approved edit on Why is “www.” considered unsafe in this HTTPS URL?
Apr
10
comment Mobile Carrier Javascript Injection
This is not clear. At first sight, I had understood "a clear option to opt-out is a clear violation". The opposite of what you certainly want to say.
Jan
27
awarded  Critic
Jan
27
comment Should websites be allowed to disable autocomplete on forms or fields?
But what if the person using your computer is you ? Which is the case most of the time.
Jan
27
comment Should websites be allowed to disable autocomplete on forms or fields?
I see that the OWASP gives really bad advice — in addition to using the wrong words.
Mar
6
answered Does disabling right click have any impact on security?
Mar
6
comment FireFox's restore previous session restores logins authenticated by server's sessions
@Celeritas — “If the "remember me" check box is not checked then the session will still be remembered in Firefox.” This is because you did not set a cookie duration, no ? You can set a cookie duration if you want the login to expire. For instance 24 h. If I were a user of your site, I would probably not like that, but I think that would achieve the goal you want.
Mar
5
comment FireFox's restore previous session restores logins authenticated by server's sessions
@Celeritas — When I check a box named Remember, I want the site to… remember. As always, security harms usability and usability harms security. So in fine the right thing to do depends on the situation and on the user's choice. Is the system the entry control of a CIA bunker or a daily life Web site ? Does the user trust his own computer in his own house ? It is good to let the user make his/her informed choice and to respect it. Hence the Remember check box, and the security explanation next to it. Thus, if the user is in a fragile situation, s/he can choose not to be remembered.
Mar
5
awarded  Supporter
Mar
4
awarded  Teacher
Mar
4
answered FireFox's restore previous session restores logins authenticated by server's sessions
Mar
4
answered Account lockout with human interaction required to unlock
Feb
23
answered How to prevent attacks against client side validations?
Feb
23
answered Why are iframes allowed at all in modern browsers?