meta user
network profile
| bio | website | joellimberg.com |
|---|---|---|
| location | Tallinn, Estonia | |
| age | ||
| visits | member for | 2 years, 6 months |
| seen | yesterday | |
| stats | profile views | 5 |
I make useful web things
|
May 8 |
awarded | Enlightened |
|
May 8 |
awarded | Nice Answer |
|
May 3 |
comment |
Stopping js malware injection on our Wordpress site There are many potential ways to attack a Wordpress install (or any web app for that matter). For a start you should read codex.wordpress.org/Hardening_WordPress |
|
Apr 12 |
comment |
Secure login system - using sessions? Cool. You should also add "…and the X-Frame-Options: deny header" to your last sentence. The header is now supported by all/most modern browsers, so JS shouldn't even be needed for that, soon. |
|
Apr 12 |
comment |
Secure login system - using sessions? I'm sorry, but that's not really accurate. Clickjacking would imply embedding the site in frame, and tricking the user to make actions in that frame. A hidden POST request doesn't require any user interaction. |
|
Apr 12 |
awarded | Commentator |
|
Apr 12 |
comment |
Best practice for securing user credentials once they reach the server using Basic Auth + SSL It's actually covered by the answer below, but I'll reiterate: you should never store a password in a way that enables anyone (including yourself) to figure out the original (plaintext) password. |
|
Apr 12 |
comment |
Secure login system - using sessions? Regarding "use POST" - this will not protect against CSRF attacks, at all. Malicious sites can just as easily send POST requests (hidden forms and iframes). |
|
Apr 12 |
comment |
Client code tampering detection As AJ Henderson answered, it's not really possible. The best you can realistically do is have the clients send a hash of their application code (and config files, etc) to your server, and you can validate that against a known value. This will protect you from attacks that are not specifically tailored against your application - eg. if a malicious process modifies all apps running on the client. (If the malicious process is aware of the signing process, it will be able to intercept that validation, rendering it useless.) |
|
Mar 16 |
answered | If a “man in the middle attack” obtains the username & password of user, are there mechanisms that can prevent them connecting to server? |
|
Mar 16 |
comment |
If a “man in the middle attack” obtains the username & password of user, are there mechanisms that can prevent them connecting to server? A MITM attacker can also intercept and spoof the MAC address, so that wouldn't help in this scenario. |
|
Feb 22 |
comment |
How to remember a trusted machine using two factor authentication (like Google's system) Google also has a way to revoke all "remembered computers", so if my machine is compromised or stolen, I can revoke access. You should also automatically revoke all authorized computers if the user password is changed. |
|
Feb 22 |
comment |
How to remember a trusted machine using two factor authentication (like Google's system) There is really no point in using anything other than a cookie with a long random identifier. If the attacker has access to a machine, they'll be able to extract any other information anyway. Plus, if you use something like navigator.plugins or the User-Agent string, then the attacker can simply direct the user to his own site (via, for example, a phishing email) and extract the same information; but the attacker can't extract the cookie information that way. |
|
Dec 27 |
answered | Chrome SSL Warning: “You cannot proceed because the website operator has requested heightened security for this domain. ” |
|
Dec 14 |
awarded | Yearling |
|
Dec 14 |
answered | What issues arise from sharing a SSL certificate's private key? |
|
Dec 12 |
awarded | Critic |
|
Dec 4 |
awarded | Editor |
|
Dec 4 |
revised |
Securing an API for mobile access added a basic example solution |
|
Dec 4 |
answered | Securing an API for mobile access |
