22,939 reputation
343106
bio website
location Brooklyn, NY
age 34
visits member for 4 years, 3 months
seen 16 hours ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jan
24
answered Retrieving saved password from Firefox on Linux
Jan
23
answered Should sensitive data ever be passed in the query string?
Jan
21
revised Is this acceptable login security?
added 228 characters in body
Jan
20
revised Is this acceptable login security?
added 44 characters in body
Jan
20
revised Is this acceptable login security?
added 59 characters in body
Jan
20
revised Is this acceptable login security?
deleted 78 characters in body
Jan
20
revised Is this acceptable login security?
deleted 78 characters in body
Jan
20
answered Is this acceptable login security?
Jan
18
answered How to store banking information,collected on website, securely and implement encryption?
Jan
16
awarded  Nice Answer
Jan
14
comment Are passwords stored in memory safe?
@CodesInChaos - Exactly. SecureString uses the Data Protection API; which was reverse engineered in 2010 (not sure if MS has changed since then). Its not trivial to break (e.g., if you had full access to a system; its much easier to just capture the password before it hit the SecureString with say a keylogger). However, since the running application has to be able to decrypt it; a sophisticated analysis (with full access to disk/memory) has to be able to recover it.
Jan
14
comment Are passwords stored in memory safe?
@Giffyguy - It makes sense to use a SecureString in .NET for several reasons, but it doesn't prevent sophisticated "hackers who sneak peeks at your applications memory" from getting at the password; it adds obfuscation though. SecureStrings will be encrypted in memory; however the key to decrypt will necessarily also be in memory. Still this is better than a plaintext pw in memory, so it isn't ever exposed in a coredump/swapfile/etc.
Jan
13
answered UNION SQL Injection
Jan
10
comment Is Django's built-in security enough?
Also to answer @freshquiz questions: extra() is fine if its not based on manual string processing like Entry.objects.extra(where=['%headline=%s' % user_input]). There is a safe way to do that -- with params that makes it a bound parameter see: docs.djangoproject.com/en/dev/ref/models/querysets/… . Also no problem with initially developing without SSL, just be sure to thoroughly test with SSL before deploying.
Jan
10
comment Is Django's built-in security enough?
+1 - D.W. had a great comprehensive answer, but you should definitely be aware of the types of attacks and code safely using best practices. Django has a great framework, but even the best tool let's you still do stupid things. E.g., if you say modify DB data based on HTTP GET requests (instead of POST) you are vulnerable to CSRF. Or if you let users inject HTML content that you've mark_safe or {{ something|safe }}, they maybe able to inject say an HTML <script> element on the page for XSS. Or if you have django call a python shell command based on user input (to say create a file).
Jan
2
answered Is it possible to change the wifi password with a script?
Dec
31
comment Future proof encryption possible in theory?
To quote wikipedia: "One-time pads solve few current practical problems in cryptography ... Because the pad, like all shared secrets, must be passed and kept secure, and the pad has to be at least as long as the message, there is often no point in using one-time padding, as you can simply send the plain text instead of the pad (as both can be the same size and have to be sent securely)." This fault is only present with the OTP; not with say key generated from a passphrase with a KDF.
Dec
31
comment Future proof encryption possible in theory?
@GrahamHill, KeithS - You are ignoring KDFs. It's easy to commit a high-entropy passphrase (say ~10+ random dictionary words) to memory to the individuals who need permission (passed generation to generation). You can clearly document the key derivation function used with the encrypted message. With an OTP, on the other hand you need to keep a secret message of the same length as the total length of all the encrypted messages.
Dec
27
comment Future proof encryption possible in theory?
@Cromulent - Yes, you gain a little security via obscurity (the location of the N bank lock boxes; make you break it N+1 times -- generalizing to the case where your message was XORed with N different OTP). But from Kirchhoff's principle, you strive for more than security by obscurity. The designed in security arises only from the lockbox; (and any lockbox can be broken -- picking a lock, forging a signature, bribing your way in, is not impossible like brute forcing a good implementation of AES-256). Not to say OTP is useless; just long term encrypted message storage is not a good fit for it.
Dec
23
awarded  Cleanup