16,285 reputation
12583
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 26 mins ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


May
22
comment Worst case scenario, what can a Chrome extension do with “Your data on all websites” and “Your tabs and browsing activity”?
@GeorgeBailey - I'm not sure how well they can effectively use an http only cookie with modern content security policy (preventing inline scripting; loading external non-https scripts) / same-origin policy. Its little difference as they can still just capture your actual username / password from whenever you actually log in somewhere.
May
22
comment Are common passwords at particular risk?
If you implement rules like 1 upper case / 1 lower / 1 special / 1 number, you should have an exception for passphrases that tend to be have much higher entropy, easier to type, and easier to remember. (E.g., if pass is longer than ~20 chars; drop other requirements; though possibly still run through common password dictionary).
May
22
answered In the Diffie-Hellman key exchange, how is the shared base key 'p' known and how are A and B, protected from Eve?
May
22
comment Are prepared statements 100% safe against SQL injection?
@BruceEdiger - Lateral SQL injection in your link can't happen if you use prepared statements with bound parameters. In pseudocode, if one defines sql_str = "SELECT name FROM all_objects WHERE created = ?" and then did prepared_stmt = db_cursor.prepare(sql_str), prepared_stmt.execute_with_param(SYSDATE), you can't use SYSDATE to inject code to alter the execution plan as the execution plan was determined in the prepare() step independent of SYSDATE's value. (Unless there's another vulnerability). The lateral flaw is doing naive string processing to construct an SQL statement.
May
22
comment Are common passwords at particular risk?
@Ben Brocka - If you want to make it more difficult for offline attacking of hashes (and use techniques like key-strengthening + unique salt), yes disallow any password you can find from any list with a million+ passwords, which in an optimized database should take under a millisecond to check. If you can find an attempted password existing in some million+ password list, so can a dictionary attacker. Trying a million passwords is roughly equivalent to brute-forcing 4 lowercase letters (which you also should not allow).
May
22
answered Are common passwords at particular risk?
May
22
comment Are common passwords at particular risk?
I agree that (2) is a bad choice as it prevents strong passphrases while allowing weak Passw0rds leading to bad UX. It also depends on the sensitivity of a compromise and how much you want to make yourself a target. If you are facebook/reddit/stackexchange, you can probably get away with warning, but ultimately allowing weak passwords. If you are online merchant that remembers credit card details, you are asking for attacks that will cost you money (and lead to a very bad UX) if Passw0rd is allowed.
May
22
awarded  Yearling
May
21
comment Are prepared statements 100% safe against SQL injection?
@pipTheGeek - Interesting. I use postgresql as my rdbms of choice (free software) and cannot find this option, and MySQL specifically says they do not support 'WITH RECOMPILE'. I think you may be able to do something similar in postgres if you first wrote a stored procedure and then did a prepared statement calling it--but not sure it would recompile execution plan (would need to check).
May
21
answered Are prepared statements 100% safe against SQL injection?
May
21
revised For what malicious activity can one use a computer with a high-end GPU?
grammar
May
21
comment For what malicious activity can one use a computer with a high-end GPU?
@D.W. - You are probably right. The step of generating a decryption key from a password is easily parallelizable with a GPU (exactly similar to hashing). Applying each key to completely decrypt a file is not easily parallelizable with a GPU, and I was imagining some sort of bottleneck there with checking that the file appears to have been successfully decrypted (unlike a hash where you know the exact outcome hash you want the password to turn into). However, you can just attempt to decrypt say the first (few) block(s) and do a check if it appears to be valid data.
May
19
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
added 1 characters in body
May
19
comment Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
@JohnC - Sorry for the incorrect original responses. I wasn't I was using any HttpRedirectResponse in my original apps and never had the issue; but once you brought it up; did a quick search of the source code and found the fix. I've reformatted the answer here and also put on SO.
May
19
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
deleted 1777 characters in body
May
19
answered For what malicious activity can one use a computer with a high-end GPU?
May
19
comment Hiding version - valuable or just security by obscurity?
@jldugger - agree; my language was sloppy/confusing. Basically meant that 0-day comes out, some people start trying to patch it and some people start trying to exploit it. Even if a workaround (disable the vulnerable feature; migrate to an older version) or security patch comes out for the vulnerability (and it stops being a 0-day) you may not have time to roll out the fix, and its in your best interest not to advertise you are still vulnerable.
May
18
comment Could mint.com be more secure, and if so, how?
Agreed. Note some banks like ING direct do offer a read-only access code for these services. Its pitiful that all major banks do not.
May
18
revised Is there repetition in the Solaris 11 hash routine? Can I add some?
added 760 characters in body
May
18
revised Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
added 925 characters in body