22,759 reputation
342106
bio website
location Brooklyn, NY
age 34
visits member for 4 years, 2 months
seen Jul 29 at 3:39
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jul
25
awarded  Constituent
Jul
22
comment Token-based authentication - what's a good token length?
Meanwhile if your application has say 10 million session tokens in existence, and some botnet attacks your application and manages to do a million requests per second, it would take ~21 days to find one of the 10 million existing session tokens. With a 128-bit session token, it would take more than 10 million times the age of the universe (10 million x 13.7 billion years) to find one of the 10 million session tokens. And with 128-bit, you don't run into collision problems until you have about 2^64 tokens out there which is about 2 billion tokens for every human on earth).
Jul
22
comment Token-based authentication - what's a good token length?
The reason 64-bit is insufficient is that you often don't need to find a specific session token and your system may have millions or billions of session tokens. The chance of session tokens natually colliding among users happens at 2^32~4 billion tokens (see birthday problem ). This could be problematic; and it is not unreasonable to expect very large web applications (or attacked web applications) to eventually generate 4+ billion session tokens.
Jul
21
awarded  Guru
Jul
20
awarded  Caucus
Jul
8
revised Is my ISP trying to impersonate google?
Make image visible instead of dropbox link.
Jun
30
revised is it easier to eavesdrop on ethernet connection rather than wifi?
Crossed out admitted mistaken idea in case someone doesn't read comments.
Jun
30
comment is it easier to eavesdrop on ethernet connection rather than wifi?
This is simply false. WPA and WPA2 (and even WEP, though WEP is broken and should not be used) encrypts the radio transmissions between your laptop/mobile device and the wifi access point.
Jun
24
awarded  Nice Answer
Jun
19
awarded  Notable Question
Jun
5
revised Can a wifi provider decrypt HTTPS usind MITM without users noticing?
added 8 characters in body
Jun
5
answered Can a wifi provider decrypt HTTPS usind MITM without users noticing?
Jun
2
awarded  Nice Answer
May
27
comment How to hack into a remote mysql database?
Yes. The MITM tricks the client into believing the server doesn't support SSL. You fix this by upgrading the clients to 5.7.3 or greater, or don't talk to your database over untrusted networks (e.g., use it only as a local application, or a small private network, or over a secure VPN).
May
22
awarded  Yearling
May
19
answered How to hack into a remote mysql database?
May
17
awarded  Nice Answer
May
14
comment Why will Google no longer allow me to end or begin passwords with a space?
My point was from a security perspective, its safer to tell you after inputting a password in a form that will be modified prior to hashing, that "we don't allow passwords greater than 8 characters/with this special character/with unicode characters/with starting/trailing whitespace" while you are setting your password.
May
14
answered Why will Google no longer allow me to end or begin passwords with a space?
Apr
18
comment Do search engines give searcher's IP address to sites that come up in search?
@tim - if the site owner uses google analytics, you get the searched keywords from looking at the analytics. (You won't get them for each individual user straight from google; but if you say cross reference info from the time, user agent, etc with keyword searches you can match them up in your logs.