924 reputation
410
bio website joellimberg.com
location Tallinn, Estonia
age
visits member for 3 years, 11 months
seen 4 hours ago

I make useful web things


Sep
24
awarded  Autobiographer
Jul
31
comment User Account Guessing
@ArtjomB — in this scenario the point is that the attacker would not know if the email address he tried was previously used for an account. He'd simply get the "Please check your inbox to proceed creating your account" message. And if the user himself accidentally tried to create an account, they'd get an email saying "Welcome back, you already had an account".
Jul
31
answered User Account Guessing
Jul
26
comment Self signed certificate on application server behind web front end
@bhttoan — so, your users' browsers do actually connect directly to Tomcat to load JS files?
Jul
25
comment Is there something similar to pseudorandom generators but in the opposite direction?
@HSN — what's the use case for this?
Jul
8
comment Apache redirecting to unsecure port
@marstato — yes, certainly. Or probably something like an appliction-specific get_full_url('login') helper.
Jul
7
comment Apache redirecting to unsecure port
I think it's required (according to specifications) to include the full url in redirect headers. A vast majority of browsers will handle relative URLs correctly, but it might cause problems in some cases. Also, having the https protocol present ensures that http:/example.com will always redirect to the secure login page.
Jul
7
answered Apache redirecting to unsecure port
Jun
28
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
— I mean that there aren't any real-life Flash issues that would force people to always block Flash. If there was, most computers browsing the web would get infected immediately. Of course disabling things does increase "theoretical" security, but I wouldn't say that's in any way a requirement for safe browsing.
Jun
28
comment How to safely show some text on a webpage?
I would add that there is a theoretical risk with the page being cached (on disk), and other users being able to access the information that way. To mitigate that risk, the site would need to add certain no-cache/no-store headers.
Jun
28
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
Java might be a risk, but Flash is so common and widely used that any exploits would get you anyway, on any website (shady ad networks, or shady ad providers on reputable ad networks, etc etc)
Jun
21
revised SSL Mutual authentication Fails
typo fix + tiny copy edits
Jun
21
reviewed No Action Needed Ldap differences between {crypt} and {CRYPT}
Jun
21
reviewed Reviewed How to detect the so-called “undetectable” Gameover Zeus?
Jun
21
comment How to detect the so-called “undetectable” Gameover Zeus?
I'd highly recommend you edit your post so it's actually readable.
Jun
21
suggested suggested edit on SSL Mutual authentication Fails
Jun
18
revised How to block the websites on client machines
corrected spelling and formatting
Jun
18
revised Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?
un-censor the word "censorship"
Jun
18
awarded  Custodian
Jun
18
reviewed Reviewed How to block the websites on client machines