1,538 reputation
1821
bio website traveljournal.net
location Netherlands
age
visits member for 3 years, 4 months
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


Jul
2
awarded  Curious
Apr
18
awarded  Yearling
Feb
22
awarded  Popular Question
Feb
17
awarded  Nice Question
Feb
4
awarded  Announcer
Nov
24
awarded  Favorite Question
Oct
30
awarded  Nice Answer
Sep
13
awarded  Popular Question
Jun
11
awarded  Popular Question
Apr
18
awarded  Yearling
Apr
7
awarded  Famous Question
Jan
10
comment How safe is “trust this computer” option for websites?
A server side expiration option also allows for a 'forget me everywhere' button, thereby allowing the user to expire cookies for all previously trusted computers.
Jan
10
comment Is it possible to make an xss with only html tags
@Polynomial, yeah, I noticed two other answers mention it, but only after commenting. I was about to delete the comment, but now you already noticed.
Jan
10
comment Is it possible to make an xss with only html tags
onmouseover requires user interaction, onerror fires on pageload.
Dec
30
comment E-mail can be made to appear like it came from a big organization?
SPF is not broadly implemented
Dec
24
comment How can encrypted traffic bypass the Great Firewall of China when it is being blocked?
related: security.stackexchange.com/q/3317/2113
Dec
13
comment Does including decorative HTTP headers into server reply pose extra security risk?
not a security issue, but extra headers do consume (some) extra bandwidth.
Dec
10
comment What are the disadvantages of single sign-on authentication?
I'm pretty sure, the avarage user would not use a better password for a single sign-on solution. Most don't care and wouldn't even know the difference; to them it is just another password box they need to fill in.
Dec
2
comment How to Securely Implement a “Remember Me” Feature?
I think we both have a different approach. data such as computer name can be spoofed, IP addresses can change for many reasons. I create a 256bit random number, store the (hash of) this number in the database and set a cookie with the primary key & random number. Whomever presents the cookie is assumed to be the user associated with the DB record. (also see the answer I linked above).
Nov
30
comment How to Securely Implement a “Remember Me” Feature?
I meant to say that, because the nonce is a password equivalent, instead of the nonce, only the hash of the nonce should be stored in the database. Offcourse you also need to store things like expiration date and/or userId, etc.