1,538 reputation
1821
bio website traveljournal.net
location Netherlands
age
visits member for 3 years, 4 months
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


Jul
17
awarded  Citizen Patrol
Jul
16
comment How can I identify that my page is requested by robot, but not user's browser?
of interest "Detecting 'stealth' web-crawlers": stackoverflow.com/questions/233192/…
Jul
12
answered PHP crypt() or phpass for storing passwords?
Jul
11
accepted Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Jul
11
comment Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
@AndreyBotalov, the javascript method sends exactly the same fields as the vanilla HTML form.
Jul
11
revised Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
added 271 characters in body
Jul
10
comment Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
@AndreyBotalov, we do have an anti CSRF token in the HTML-form (the token sparked the question). Can you explain how I would use an anti-CSRF header/parameter?
Jul
10
comment Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Would an anti CSRF token, as mentnioned by AndreyBotalov, change anything?
Jul
10
revised Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
added 6 characters in body
Jul
10
comment NoScript: How to determine which sites/scripts to whitelist?
With all respect, but I was shocked by this service. Under "privacy", it claims: "When you visit a website without Light Point Web, that website’s owner can learn information about you" yes, so instead you propose to disclose everything to your service! This is beyond facebook evil.
Jul
10
revised Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
added 9 characters in body
Jul
10
asked Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Jul
9
comment Is the password hash better when you concatenate the password and username?
email and username are NOT good salt values. They fail at being unique across systems. The salt should be unique and non-predicatbale. This is meant worldwide. Best practice: use a random set of bytes with an unpredictable random generator, preferably within a salt space large enough to make collisions improbable. It is tempting to try to derive a salt from some data which is "presumably unique", but such schemes often fail due to some overlooked details. Since it is comparatively easy to creating sufficiently random salt value, stick to the best practice.
Jul
5
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
@user917279, I just wanted to link to the other question, with the questionmark I tried to indicate they might not be identical duplicates
Jul
4
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
duplicate: security.stackexchange.com/questions/3165/… ?
Jul
4
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
+1 for the good writeup. The thing that is often cited is that, if the password hashes are stolen by a limited read only vulnerability (for example SQL-injection), the attacker has, due to the absence of a secret-key, all the variables needed for an offline attack. There has been some discussion about adding both a pepper and a salt. The accepted answer there advices against HMAC and recommends BCrypt.
Jul
2
comment How to refute “don't use internet if you don't like it” answer?
"is privacy a basic human right"? according to the The Universal Declaration of Human Rights and also according to European Convention on Human Rights, it is.
Jul
2
comment Recompute Rainbow table with salt?
maybe also read: http://stackoverflow.com/questions/1645161/salt-generation-and-open-source-soft‌​ware/1645190
Jun
28
answered How to defend against invalid UTF7/8 that hides a <script> tag?
Jun
12
comment Why would salt not have prevented LinkedIn passwords from getting cracked?
If you generate the salt from some user related data, you allow the attacker to attack multiple instances of the hash (for example on separate systems) for the cost of 1 attack. If you rely on your source code to stay secret, you enter the realms of security through obscurity.