779 reputation
46
bio website joellimberg.com
location Tallinn, Estonia
age
visits member for 3 years, 5 months
seen Apr 12 at 17:04

I make useful web things


Mar
7
comment Chrome extension sends browsing information
I didn't vote you down, but your question boils down to "Is it legal for browser extensions to send my browsing data to a server?", which is not really a technical question, and can be answered with "well, it depends…"
Mar
7
comment Chrome extension sends browsing information
Might be related: arstechnica.com/security/2014/01/…
Jan
31
comment Storing session key for iOS app
Same disclaimer (I'm not an iOS dev), but it would be even better to not store the username:password, but rather get a token from the service (if possible) and only store that in the keychain. That way the user can revoke access without changing the password, and there's no risk of the password leaking…
Jan
13
comment Protecting user data via encryption
@lee — Yes, definitely. It might be "less secure" than not storing any data, but all security is about tradeoffs, and I wouldn't say this one (not storing names) would be worth it. (For a nice middle ground you could choose to only store First name + Last initial.)
Jan
13
answered Encrypt user data when they log in with Facebook, Gmail, etc
Jan
13
comment Protecting user data via encryption
@lee: you almost certainly need to store at least the email address, and it's almost always very easy to derive a name from an email address anyway — so this provides very little security benefit, but probably makes your application worse for users (emails starting with "Dear User", possibly getting caught in spam filters, etc). Direct answer: I think it is indeed overkill to store names/emails in an encrypted form — you'll need to have the key on your server anyway, and adding complex encryption will only increase the chances that you'll introduce a bug and make the app less secure, not more.
Jan
13
comment What info to log/store about a user login?
That's a very broad question with no clear answer. If you want you can provide much more detail and ask a question on stackoverflow.com.
Jan
12
answered What info to log/store about a user login?
Dec
26
revised Can non-https assets be tampered with?
fix previous, incorrect edit
Dec
26
awarded  Yearling
Dec
26
answered Can non-https assets be tampered with?
Dec
26
answered Photo Attachment's Feature For Some Mail Servers
Dec
26
comment Photo Attachment's Feature For Some Mail Servers
You really should be more specific with your questions. "Is there any security problem with [email attachments]" is extremely vague. —— What's your specific concern?
Dec
23
comment Look over my Web API Authentication Scheme
@Chrisgozd Re: multiple tokens: if I run a service that uses your API, I'll probably want to get a new token before the current one expires — but when I do, I'd still like the original token to work until its expiration time so I don't have to pause making requests while I receive a new token.
Dec
23
answered How dangerous is it to allow arbitrary webhook urls to post to?
Dec
23
comment Look over my Web API Authentication Scheme
@Chrisgozd - SELECT user_id FROM tokens WHERE token = 'THE_TOKEN'. But of course you can add the user id to tokens for faster lookups. (USERID-TOKEN-IPADDR-EXPIRATION) Also, you probably should have a standalone token table so that users can have more than one active token. Even in an API-only use case it's probably required, since many parallel requests can come in at once, and if you expire a token you might break an in-progress client request.
Dec
22
answered Look over my Web API Authentication Scheme
Dec
6
comment Is it a good idea to hash a string and use it as a passphrase?
Basically, with your method there would be a theoretical increase in security as the hash will be longer than a "simple passphrase", but in practice a "correct horse battery staple" (xkcd.com/936) type passphase is just as strong, and doesn't require an extra tool to hash your phrase every time you need the password.
Dec
5
answered Is it a good idea to hash a string and use it as a passphrase?
Nov
30
comment Access-Control-Allow-Origin header spoofing?
'curl --header "Origin: HELLOWORLD" www.google.com' — Boom, request sent w/ random Origin header. It's up to the client (that is: browser) to enforce any restrictions.