22,333 reputation
339103
bio website
location Brooklyn, NY
age 33
visits member for 4 years
seen 22 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Feb
15
reviewed No Action Needed Is this SSO design secure?
Feb
15
revised Is it safe to mix authentication methods?
added 572 characters in body
Feb
15
revised Is it safe to mix authentication methods?
added 474 characters in body
Feb
15
answered Is it safe to mix authentication methods?
Feb
14
comment Hiding JavaScript source code
@Travis - Can (client-side) JS be hidden by ____? No. For the browser to run the JS, it has to download it. I have no idea what "session layer for PHP" means. TCP/IP doesn't really have an OSI session layer (HTTP would be the application layer being equivalent of layers 5-7), though HTTP typically does (user) sessions via session cookies (unique text strings identifying a user like a guid) in HTTP request headers. I'm not aware of any browser that runs JS delivered via a cookie or HTTP header, and if one did it still wouldn't be "hidden" as it would be easily retrievable.
Feb
14
answered How to protect files (cron files) frome being executed by everyone?
Feb
14
answered Hiding JavaScript source code
Feb
14
answered Security risk of adding a HTTP Header with server identifier
Feb
14
revised What is the point of hashing passwords?
added 423 characters in body
Feb
14
answered What is the point of hashing passwords?
Feb
14
revised Brute force a GUI login?
deleted 22 characters in body
Feb
14
answered If my server was compromised, is my database safe?
Feb
14
answered Brute force a GUI login?
Feb
13
comment web services: how prevent illegal accesses
@Seraphim'shost - I should add that I have not used the Android/Google Play Licensing service. But it seems along the path of what you need. You could even use the license server response as your secret key (e.g., if its a valid license + cryptographically signed with the right key + not banned for too frequent calls), give it a validity/grace period of a week. Agree much testing is needed.
Feb
13
answered web services: how prevent illegal accesses
Feb
12
answered Is there a difference between GET and POST for web application security?
Feb
12
comment Is there a difference between GET and POST for web application security?
+1 - It's still easy for someone from evilhacker.com to have you insert POST parameters (e.g., use javascript to submit a hidden form when you load a page), which is why CSRF (cross-site request forgery) protections are necessary; typically a secret CSRF token tied to the user/session being present in the POST variables before the action is done. The difference is that if you go to nearly any discussion forum that allows users to include images you are susceptible to GET attacks. (Granted here on SE, all included images are hosted by SE so should be safe).
Feb
11
answered Hashing length for storing password
Feb
11
comment Email hacking myth
7 is an important one. That's how Sarah Palin's yahoo email was hacked. You also have to worry about things like your browser remembering your password (without a master password), so anyone walking by your computer can steal all your passwords, or accidentally not using SSL to login once, or using your email address as your login ID and accidentally typing your email password into the login field at untrustworthysite.com which then uses your password to get into your emails, ...
Feb
11
awarded  Revival