22,193 reputation
338102
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 11 months
seen 2 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Feb
14
answered How to protect files (cron files) frome being executed by everyone?
Feb
14
answered Hiding JavaScript source code
Feb
14
answered Security risk of adding a HTTP Header with server identifier
Feb
14
revised What is the point of hashing passwords?
added 423 characters in body
Feb
14
answered What is the point of hashing passwords?
Feb
14
revised Brute force a GUI login?
deleted 22 characters in body
Feb
14
answered If my server was compromised, is my database safe?
Feb
14
answered Brute force a GUI login?
Feb
13
comment web services: how prevent illegal accesses
@Seraphim'shost - I should add that I have not used the Android/Google Play Licensing service. But it seems along the path of what you need. You could even use the license server response as your secret key (e.g., if its a valid license + cryptographically signed with the right key + not banned for too frequent calls), give it a validity/grace period of a week. Agree much testing is needed.
Feb
13
answered web services: how prevent illegal accesses
Feb
12
answered Is there a difference between GET and POST for web application security?
Feb
12
comment Is there a difference between GET and POST for web application security?
+1 - It's still easy for someone from evilhacker.com to have you insert POST parameters (e.g., use javascript to submit a hidden form when you load a page), which is why CSRF (cross-site request forgery) protections are necessary; typically a secret CSRF token tied to the user/session being present in the POST variables before the action is done. The difference is that if you go to nearly any discussion forum that allows users to include images you are susceptible to GET attacks. (Granted here on SE, all included images are hosted by SE so should be safe).
Feb
11
answered Hashing length for storing password
Feb
11
comment Email hacking myth
7 is an important one. That's how Sarah Palin's yahoo email was hacked. You also have to worry about things like your browser remembering your password (without a master password), so anyone walking by your computer can steal all your passwords, or accidentally not using SSL to login once, or using your email address as your login ID and accidentally typing your email password into the login field at untrustworthysite.com which then uses your password to get into your emails, ...
Feb
11
awarded  Revival
Feb
10
comment My website has been hacked, what do i do next?
I agree with your analysis once we determine its a compromised server; but we haven't determined that his server has been compromised yet. For all we know, his application let users inject javascript in a comment form (XSS) which was then used to redirect users away from his original page. Or he had a weak application password for a CMS running on the server that allows someone to change content on his webpages (e.g., redirect to another machine), but they weren't able to compromise the machine. Or that DNS entry was changed as his pw with registrar was guessed or ...
Feb
9
answered My website has been hacked, what do i do next?
Feb
8
comment Insecure to require numbers in passwords?
@B-Con - First, use base-2 log (lg) to calculate informational entropy lg(0.02) ~ -5.6 bits. Next, OP claimed "wouldn't requiring a number remove about 90% of the possible passwords", which is wrong -- it removes ~25% (0.5bits) of the passwords using his assumptions. Third, there's 33 keyboard symbols but if you imagine only ten (why?), requiring a number and symbol reduces 72^10 to 72^10-62^10-62^10-52^10, or a reduction of 1 bit. Allowing 33 spec chars it reduces from 95^10 to 95^10-85^10-62^10-52^10 (0.6 bits). At 12-chars (password length OP assumes) this reduces by ~0.45 bits.
Feb
8
comment Insecure to require numbers in passwords?
@B-Con - If your symbol set with numbers is 72 chars, the chance any given character is a non-number is 62/72 ~ 86%. The chance that all 10 chars in the pw not being numbers is (62/72)^10 ~ 22%; quite different from 90%. (To get about 90% reduction, your password length would need to be about 1). The new password space then shrinks by 22%, so is (1-22%) of the original and since lg(xy) = lg(x)+lg(y) that means the entropy decreases by 0.4 ~ -log(1-.22) bits.
Feb
8
revised Insecure to require numbers in passwords?
added 505 characters in body