21,528 reputation
33699
bio website
location Brooklyn, NY
age 33
visits member for 3 years, 7 months
seen 4 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Feb
12
answered Is there a difference between GET and POST for web application security?
Feb
12
comment Is there a difference between GET and POST for web application security?
+1 - It's still easy for someone from evilhacker.com to have you insert POST parameters (e.g., use javascript to submit a hidden form when you load a page), which is why CSRF (cross-site request forgery) protections are necessary; typically a secret CSRF token tied to the user/session being present in the POST variables before the action is done. The difference is that if you go to nearly any discussion forum that allows users to include images you are susceptible to GET attacks. (Granted here on SE, all included images are hosted by SE so should be safe).
Feb
11
answered Hashing length for storing password
Feb
11
comment Email hacking myth
7 is an important one. That's how Sarah Palin's yahoo email was hacked. You also have to worry about things like your browser remembering your password (without a master password), so anyone walking by your computer can steal all your passwords, or accidentally not using SSL to login once, or using your email address as your login ID and accidentally typing your email password into the login field at untrustworthysite.com which then uses your password to get into your emails, ...
Feb
11
awarded  Revival
Feb
10
comment My website has been hacked, what do i do next?
I agree with your analysis once we determine its a compromised server; but we haven't determined that his server has been compromised yet. For all we know, his application let users inject javascript in a comment form (XSS) which was then used to redirect users away from his original page. Or he had a weak application password for a CMS running on the server that allows someone to change content on his webpages (e.g., redirect to another machine), but they weren't able to compromise the machine. Or that DNS entry was changed as his pw with registrar was guessed or ...
Feb
9
answered My website has been hacked, what do i do next?
Feb
8
comment Insecure to require numbers in passwords?
@B-Con - First, use base-2 log (lg) to calculate informational entropy lg(0.02) ~ -5.6 bits. Next, OP claimed "wouldn't requiring a number remove about 90% of the possible passwords", which is wrong -- it removes ~25% (0.5bits) of the passwords using his assumptions. Third, there's 33 keyboard symbols but if you imagine only ten (why?), requiring a number and symbol reduces 72^10 to 72^10-62^10-62^10-52^10, or a reduction of 1 bit. Allowing 33 spec chars it reduces from 95^10 to 95^10-85^10-62^10-52^10 (0.6 bits). At 12-chars (password length OP assumes) this reduces by ~0.45 bits.
Feb
8
comment Insecure to require numbers in passwords?
@B-Con - If your symbol set with numbers is 72 chars, the chance any given character is a non-number is 62/72 ~ 86%. The chance that all 10 chars in the pw not being numbers is (62/72)^10 ~ 22%; quite different from 90%. (To get about 90% reduction, your password length would need to be about 1). The new password space then shrinks by 22%, so is (1-22%) of the original and since lg(xy) = lg(x)+lg(y) that means the entropy decreases by 0.4 ~ -log(1-.22) bits.
Feb
8
revised Insecure to require numbers in passwords?
added 505 characters in body
Feb
8
revised Insecure to require numbers in passwords?
added 46 characters in body
Feb
8
comment Insecure to require numbers in passwords?
@B-Con - The actual calculation is straightforward to do; and shows the requirement of a number eliminates about 26% of password; reducing the entropy by about 0.45 bits
Feb
8
comment Insecure to require numbers in passwords?
Requiring a number in a 12-character password randomly generated from ASCII printable symbols removes 26% of randomly generated passwords (85/95)**12. (There are 95 printable ascii chars, and 85 of them aren't numbers; so the chance they all are not numbers is 85/95**12.) This barely makes a dent in the entropy - changes from ~78.8 bits to ~78.4 bits.
Feb
8
revised Insecure to require numbers in passwords?
added 349 characters in body
Feb
8
answered Insecure to require numbers in passwords?
Feb
8
revised How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
added 414 characters in body
Feb
8
answered How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
Feb
8
comment How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
I don't think CSP is an answer for this facebook case, as CSP is for limiting external domains can run code to a small subset. The individual webpages actively chose to include JS code from facebook.com so signed in users could like a page (so a click would say ajax push info to facebook's servers). Someone at facebook.com either accidentally or maliciously changed this information to automatically forward users to facebook.com.
Feb
8
comment How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
@Ramhound - I love how "dozens of sites" forwarding users (who are actively logged into facebook) being incorrectly forwarded facebook.com for a 15-20 minute period equals bringing down "half the internet".
Feb
8
revised How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
edited body