147 reputation
6
bio website qwerty.ms
location Romania
age 25
visits member for 3 years, 4 months
seen Apr 17 '12 at 17:39

Young web and windows programmer, hacker, dancer, drawing artist, modeling artist, engineer and more


Apr
6
comment Securing communication
I accept this as solution, as a "there's no way to do it". I found something tho (but I really had a big luck, and it's really situation specific solution), so I think I'll manage. Anyway, thanks for the help.
Apr
6
awarded  Scholar
Apr
6
accepted Securing communication
Apr
3
awarded  Critic
Apr
2
comment Securing communication
I'm not getting the username from the user, I'm fetching it from the website. The session is a good idea, but how can I create it? (I don't understand this: "matching it to a username on first access"). Getting the password from user sounds like the best solution so far, but I think it's a bit hard to verify that. It's also really troublesome for both me (implementing) and the users (using it). And finally, if it's openid it might as well be the youtube api, but I cant see how could I use that either (it's a client not a website). An application specific sercie sounds good, but is there any?
Apr
2
comment Securing communication
How would https improve on this problem? Because I don't see anything https can offer that would lessen the risk (except MITM I don't care about). Also I'm not willing to implement a foolproof security (image download blockers are far from being foolproof, yet they are still considered security). The thing is, I can't have a no-security scenario either. I'd like to get the maximum I could get from whats given. I don't want to secure against MITM, I just want to distinguish valid requests coming from the add-on by those builded manually (I think thats what is called replay attack).
Apr
2
revised Securing communication
changed title
Apr
2
awarded  Editor
Apr
2
revised Securing communication
added 95 characters in body
Apr
2
asked Securing communication
Apr
2
comment Password in file .php
+1 I like this answer the most. But I need to note that places outside of web root are still accessible on websites with local file inclusion vulnerabilities. Well the hacker would still need to guess the location.
Dec
16
awarded  Supporter
Dec
15
awarded  Teacher
Dec
15
answered XSS in SWF file
Apr
23
awarded  Autobiographer