meta user
network profile
| bio | website | |
|---|---|---|
| location | Brooklyn, NY | |
| age | 31 | |
| visits | member for | 2 years |
| seen | 10 hours ago | |
| stats | profile views | 275 |
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.
Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.
Mostly program/script in python, django, and jquery these days doing mostly web apps.
Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.
Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).
|
Feb 15 |
revised |
Is it safe to mix authentication methods? added 572 characters in body |
|
Feb 15 |
revised |
Is it safe to mix authentication methods? added 474 characters in body |
|
Feb 15 |
answered | Is it safe to mix authentication methods? |
|
Feb 14 |
comment |
Hiding JavaScript source code @Travis - Can (client-side) JS be hidden by ____? No. For the browser to run the JS, it has to download it. I have no idea what "session layer for PHP" means. TCP/IP doesn't really have an OSI session layer (HTTP would be the application layer being equivalent of layers 5-7), though HTTP typically does (user) sessions via session cookies (unique text strings identifying a user like a guid) in HTTP request headers. I'm not aware of any browser that runs JS delivered via a cookie or HTTP header, and if one did it still wouldn't be "hidden" as it would be easily retrievable. |
|
Feb 14 |
answered | How to protect files (cron files) frome being executed by everyone? |
|
Feb 14 |
answered | Hiding JavaScript source code |
|
Feb 14 |
answered | Security risk of adding a HTTP Header with server identifier |
|
Feb 14 |
revised |
What is the point of hashing passwords? added 423 characters in body |
|
Feb 14 |
answered | What is the point of hashing passwords? |
|
Feb 14 |
revised |
Brute force a GUI login? deleted 22 characters in body |
|
Feb 14 |
answered | If my server was compromised, is my database safe? |
|
Feb 14 |
answered | Brute force a GUI login? |
|
Feb 13 |
comment |
web services: how prevent illegal accesses @Seraphim'shost - I should add that I have not used the Android/Google Play Licensing service. But it seems along the path of what you need. You could even use the license server response as your secret key (e.g., if its a valid license + cryptographically signed with the right key + not banned for too frequent calls), give it a validity/grace period of a week. Agree much testing is needed. |
|
Feb 13 |
answered | web services: how prevent illegal accesses |
|
Feb 12 |
answered | Is there a difference between GET and POST for web application security? |
|
Feb 12 |
comment |
Is there a difference between GET and POST for web application security? +1 - It's still easy for someone from evilhacker.com to have you insert POST parameters (e.g., use javascript to submit a hidden form when you load a page), which is why CSRF (cross-site request forgery) protections are necessary; typically a secret CSRF token tied to the user/session being present in the POST variables before the action is done. The difference is that if you go to nearly any discussion forum that allows users to include images you are susceptible to GET attacks. (Granted here on SE, all included images are hosted by SE so should be safe). |
|
Feb 11 |
answered | Hashing length for storing password |
|
Feb 11 |
comment |
Email hacking myth 7 is an important one. That's how Sarah Palin's yahoo email was hacked. You also have to worry about things like your browser remembering your password (without a master password), so anyone walking by your computer can steal all your passwords, or accidentally not using SSL to login once, or using your email address as your login ID and accidentally typing your email password into the login field at untrustworthysite.com which then uses your password to get into your emails, ... |
|
Feb 11 |
awarded | Revival |
|
Feb 10 |
comment |
My website has been hacked, what do i do next? I agree with your analysis once we determine its a compromised server; but we haven't determined that his server has been compromised yet. For all we know, his application let users inject javascript in a comment form (XSS) which was then used to redirect users away from his original page. Or he had a weak application password for a CMS running on the server that allows someone to change content on his webpages (e.g., redirect to another machine), but they weren't able to compromise the machine. Or that DNS entry was changed as his pw with registrar was guessed or ... |
