1,508 reputation
1821
bio website traveljournal.net
location Netherlands
age
visits member for 3 years, 3 months
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


Jul
17
awarded  Citizen Patrol
Jul
16
comment How can I identify that my page is requested by robot, but not user's browser?
of interest "Detecting 'stealth' web-crawlers": stackoverflow.com/questions/233192/…
Jul
12
answered PHP crypt() or phpass for storing passwords?
Jul
11
accepted Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Jul
11
comment Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
@AndreyBotalov, the javascript method sends exactly the same fields as the vanilla HTML form.
Jul
11
revised Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
added 271 characters in body
Jul
10
comment Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
@AndreyBotalov, we do have an anti CSRF token in the HTML-form (the token sparked the question). Can you explain how I would use an anti-CSRF header/parameter?
Jul
10
comment Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Would an anti CSRF token, as mentnioned by AndreyBotalov, change anything?
Jul
10
revised Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
added 6 characters in body
Jul
10
comment NoScript: How to determine which sites/scripts to whitelist?
With all respect, but I was shocked by this service. Under "privacy", it claims: "When you visit a website without Light Point Web, that website’s owner can learn information about you" yes, so instead you propose to disclose everything to your service! This is beyond facebook evil.
Jul
10
revised Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
added 9 characters in body
Jul
10
asked Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Jul
9
comment Is the password hash better when you concatenate the password and username?
email and username are NOT good salt values. They fail at being unique across systems. The salt should be unique and non-predicatbale. This is meant worldwide. Best practice: use a random set of bytes with an unpredictable random generator, preferably within a salt space large enough to make collisions improbable. It is tempting to try to derive a salt from some data which is "presumably unique", but such schemes often fail due to some overlooked details. Since it is comparatively easy to creating sufficiently random salt value, stick to the best practice.
Jul
5
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
@user917279, I just wanted to link to the other question, with the questionmark I tried to indicate they might not be identical duplicates
Jul
4
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
duplicate: security.stackexchange.com/questions/3165/… ?
Jul
4
comment Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
+1 for the good writeup. The thing that is often cited is that, if the password hashes are stolen by a limited read only vulnerability (for example SQL-injection), the attacker has, due to the absence of a secret-key, all the variables needed for an offline attack. There has been some discussion about adding both a pepper and a salt. The accepted answer there advices against HMAC and recommends BCrypt.
Jul
2
comment Are passwords made up from concatenating a few foreign words better than shorter random characters?
duplicate: security.stackexchange.com/questions/6095/…
Jul
2
comment How to refute “don't use internet if you don't like it” answer?
"is privacy a basic human right"? according to the The Universal Declaration of Human Rights and also according to European Convention on Human Rights, it is.
Jul
2
comment Recompute Rainbow table with salt?
maybe also read: http://stackoverflow.com/questions/1645161/salt-generation-and-open-source-soft‌​ware/1645190
Jun
28
answered How to defend against invalid UTF7/8 that hides a <script> tag?