162 reputation
8
bio website timothy.green.name
location
age
visits member for 3 years, 1 month
seen 11 hours ago

A qualified chemist who somehow drifted into web development. I've learned (to a greater or lesser degree of accuracy) PHP and JavaScript, and would like to learn something completely different for the sake of it. I'm a weirdo who actually enjoys reading (and sometimes writing) technical documentation.


Jul
15
comment How to filter POST requests before they reach PHP on Apache?
Why are your usernames and passwords restricted to 16 characters?
Jun
23
comment How can I protect my eCommerce site from stolen credit cards?
The generic name for that kind of thing, @RodMacPherson, is 3D Secure. Visa, MasterCard, and American Express all follow the same standard.
Apr
24
comment How can I create a password that says “SALT ME!” when hashed?
@Rik. Code Golf SE is actually for programming puzzles in general. (See their popular "code-trolling" tag for some non-golf examples.)
Jan
24
comment Why are chips safer than magnetic stripes?
It really is hard to believe that the USA is still using non-chip cards. I think I vaguely remember my parents having those when I was a young kid.
Oct
7
comment How to be secure your page from Zeus Trojan?
An attack like what? (I'm not watching a YouTube video from work.)
Sep
18
comment What are the reasons this SQL injection code wouldn't work?
I think that PHP allows only one MySQL query at a time.
Aug
22
comment How can I choose a strong password that is easy use on a smartphone?
Very nice, but it's actually referenced in the question, so I don't see what it adds as an answer.
Aug
8
comment Are there any guidelines for passwords that need to be read out loud?
@TobiasKienzler. That's not the "British Pound". It's the pound. The Irish pound and the Cypriot pound used the same symbol, and so, according to Wikipedia, do the Egyptian, Syrian, and Lebanese pounds. (It's also Shift+3, by the way.)
Jul
5
comment Prevent my site from being copied
HT Track respects exclusions in robots.txt, but "any similar program" might not.
Jun
11
comment Are different top level domains somehow different security wise?
Not a full answer, but tangentially relevant: It would be impossible to register the domain www.xn--pypal-4ve.info. The .info registrar would not allow it.
Feb
13
comment Lessons learned and misconceptions regarding encryption and cryptology
H(json_encode(array("builtin", "securely"))) might do it. And @penguat. Realex Payments use a hash of that form in processing credit cards: H(H(various)|secret).
Jan
25
comment Content hashes to help protect resources being fetched from a CDN
Isn't something along these lines already done for flash .swz files? I vaguely recall reading about that one time.
Nov
7
comment Manually adding 's' to 'http'
let us continue this discussion in chat
Nov
7
comment Manually adding 's' to 'http'
@Iszi. Quite. It's not strange. At all. At all at all. I know that. And I'd expect everyone else to know it. So .... I feel I'm not explaining myself well.
Nov
7
comment Manually adding 's' to 'http'
@Iszi. Sorry, perhaps I should have put the word strangely in italics.
Nov
7
comment Manually adding 's' to 'http'
On shared hosting, it seems quite common for a HTTPS request to respond with a certificate made out to snakeoil.dom signed by the Snake Oil CA. Strangely, browsers don't trust this (not least because the domain name doesn't match), but the connection is still encrypted.
Oct
24
comment A safe license System
Some programs "phone home" for license verification, but if they can't reach their home server, they assume that everything's working. So they'll be fine as long as you're offline (or, being nastier, you can edit your hosts file and redirect their home servers to the loopback address).
Feb
15
comment Am I wrong to believe that passwords should never be recoverable (one way hash)?
Report them to Plain Text Offenders.
Oct
25
comment Should I prevent sending of GET requests for urls that are normally operated with POST request?
As in, in PHP, check the $_POST array, not the $_REQUEST array.
Aug
26
comment How can my country's legal/telecoms environment protect against cold-callers conning a remote-access session to the victim's computer?
Happened to my mother here in Ireland. She called me in a panic. I assured her she could safely ignore it.