2,112 reputation
828
bio website techwalablog.blogspot.com
location Mumbai, India
age 24
visits member for 1 year, 8 months
seen 2 days ago

If you think technology can solve your security problems, then either you don't understand the problems or you don't understand the technology.


Nov
12
comment Session fixation in Java
I think there is a slight confusion here. The method getSession(false) does create a new session as a new jsessionid cookie is set after the authentication step (c1 != c2). This behavior is secure but unexpected.
Nov
12
comment Session fixation in Java
The expected behavior in this case would be reuse of the initial cookie after authentication as I am calling the getSession method with a boolean false parameter. There is a difference between getsession() and getSession(false). Please refer to the documentation link given in the question
Nov
12
comment Session fixation in Java
The question clearly states that tomcat 7 was used and can you please elaborate your point where you say 'this is typical behavior' ?
Nov
11
asked Session fixation in Java
Nov
10
awarded  Custodian
Nov
10
comment Intel How Strong is Your Password page, good advice?
Mr. Downvoter, please leave a comment to help me improve this answer
Oct
15
awarded  Guru
Oct
2
comment Session Hijacked in case javascript blocked
The link has some great quality content.. +1.
Oct
2
revised Session Hijacked in case javascript blocked
added 70 characters in body
Oct
2
answered Session Hijacked in case javascript blocked
Sep
30
awarded  Explainer
Sep
2
awarded  Popular Question
Aug
8
comment What is your way to create good passwords that can actually be remembered?
@CodesInChaos My assumption is that it will be difficult for an attacker to get his hands on a dictionary of non-English passwords. The recommendation is to use a mix of English and the native language.
Jul
17
awarded  Popular Question
Jul
6
awarded  Good Answer
Jul
2
awarded  Curious
Jun
16
accepted comparing password hashing algorithms - PoC ideas?
Jun
15
revised comparing password hashing algorithms - PoC ideas?
added 47 characters in body
Jun
15
comment Authentication through digital certificates plus signature
Yes,A certificate is a container for the public key which is used for validation as explained by Mr.Pornin.
Jun
15
revised Authentication through digital certificates plus signature
deleted 11 characters in body