2,162 reputation
828
bio website techwalablog.blogspot.com
location Mumbai, India
age 24
visits member for 1 year, 9 months
seen Dec 13 at 12:09

If you think technology can solve your security problems, then either you don't understand the problems or you don't understand the technology.


Nov
12
comment Session fixation in Java
I think there is a slight confusion here. The method getSession(false) does create a new session as a new jsessionid cookie is set after the authentication step (c1 != c2). This behavior is secure but unexpected.
Nov
12
comment Session fixation in Java
The expected behavior in this case would be reuse of the initial cookie after authentication as I am calling the getSession method with a boolean false parameter. There is a difference between getsession() and getSession(false). Please refer to the documentation link given in the question
Nov
12
comment Session fixation in Java
The question clearly states that tomcat 7 was used and can you please elaborate your point where you say 'this is typical behavior' ?
Nov
11
asked Session fixation in Java
Nov
10
awarded  Custodian
Nov
10
comment Intel How Strong is Your Password page, good advice?
Mr. Downvoter, please leave a comment to help me improve this answer
Oct
15
awarded  Guru
Oct
2
comment Session Hijacked in case javascript blocked
The link has some great quality content.. +1.
Oct
2
revised Session Hijacked in case javascript blocked
added 70 characters in body
Oct
2
answered Session Hijacked in case javascript blocked
Sep
30
awarded  Explainer
Sep
2
awarded  Popular Question
Aug
8
comment What is your way to create good passwords that can actually be remembered?
@CodesInChaos My assumption is that it will be difficult for an attacker to get his hands on a dictionary of non-English passwords. The recommendation is to use a mix of English and the native language.
Jul
17
awarded  Popular Question
Jul
6
awarded  Good Answer
Jul
2
awarded  Curious
Jun
16
accepted comparing password hashing algorithms - PoC ideas?
Jun
15
revised comparing password hashing algorithms - PoC ideas?
added 47 characters in body
Jun
15
comment Authentication through digital certificates plus signature
Yes,A certificate is a container for the public key which is used for validation as explained by Mr.Pornin.
Jun
15
revised Authentication through digital certificates plus signature
deleted 11 characters in body