1,048 reputation
710
bio website joellimberg.com
location Tallinn, Estonia
age
visits member for 4 years, 7 months
seen Jun 26 at 13:08

I make useful web things


Jun
23
answered Work using net nanny
Jun
23
comment Work using net nanny
@JennyD — when "at work" (in this context), it's extremely likely anything on that computer could be monitored, SSL or not.
Feb
2
comment Risk of keeping OAuth2 client_secret in application
On the desktop, your application can also register to handle specific url schemes. As an alternative, you can use an in-app browser, so you don't have to open (for example) Google Chrome for the user to log in.
Feb
2
comment Risk of keeping OAuth2 client_secret in application
Depending on the API you're using, you can probably use a non-http url (for example, myapp://oauth-response), and capture that in your application
Feb
2
answered Risk of keeping OAuth2 client_secret in application
Jan
14
comment Double step verification system for homepage
Google Authenticator uses that very same Time-based OTP algorithm. So if you implement that, you can have your users log in using the same app (or another one that uses the same standard — most do)
Jan
14
answered Double step verification system for homepage
Jan
14
awarded  Good Answer
Dec
29
comment Email account password change via email-to-script
Exactly — regardless of any technical details, the worst part is telling your users to "email their password" — this should never ever be done, no matter the specifics of this scenario.
Dec
29
comment Email account password change via email-to-script
Sidenote: even if your script deletes the sent email, it might still persist in the user's email app. Additionally, it's a Bad Idea to teach your users it's ok to email passwords anywhere.
Dec
23
comment Which PHP encryption method is most incidentally-secure?
A "hash" and "encryption" are not the same thing, you need to make your question much more specific if you want helpful answers. That is — what exactly do you want to accomplish with "encryption"?
Dec
1
comment Does password-hashing “busy-work” need to be cryptographically secure
Yes, but there's also this general logic: "the simpler the system, the more secure it is". Because not having code means that you can't have bugs in that code (if it doesn't exist). If you re-wrap "secure stuff" in "insecure stuff", it doesn't generally reduce the security of the secure part, but it's even better to not have the insecure stuff in the first place.
Dec
1
answered Does password-hashing “busy-work” need to be cryptographically secure
Nov
30
awarded  Necromancer
Nov
19
awarded  Yearling
Sep
24
awarded  Autobiographer
Jul
31
comment User Account Guessing
@ArtjomB — in this scenario the point is that the attacker would not know if the email address he tried was previously used for an account. He'd simply get the "Please check your inbox to proceed creating your account" message. And if the user himself accidentally tried to create an account, they'd get an email saying "Welcome back, you already had an account".
Jul
31
answered User Account Guessing
Jul
26
comment Self signed certificate on application server behind web front end
@bhttoan — so, your users' browsers do actually connect directly to Tomcat to load JS files?
Jul
25
comment Is there something similar to pseudorandom generators but in the opposite direction?
@HSN — what's the use case for this?