Clockwork-Muse

406 reputation

bio	website
	location	Redmond, WA
	age
visits	member for	1 year, 10 months
	seen	2 days ago
stats	profile views	9

	406 reputation	bio	website		visits	member for	1 year, 10 months
17 badges		location	Redmond, WA		seen	2 days ago

summary answers questions tags badges favorites bounties reputation activity

49 Actions

suggestions reviews revisions comments badges posts accepts all

Oct 17	comment	If I storing my own cards in a database. Does this fall under PCI compliance framework? Agreed that PCI compliance probably shouldn't be an issue here, from a legal standpoint. However, it may still be a good idea to use some of the same criteria, to prevent certain opportunities. SQL Injection is really an orthogonal concern, so it shouldn't be the deciding factor for location (if an attacker can execute any injections, you have a problem). The configuration file actually strikes me as more suspect, as it may be easier to access by unauthorized internal parties. I'd prefer an actual database, protected as per regulations (use it for practice? ).
Sep 13	comment	Vulnerable java applications I just wanted to make it clear that, when you run against a 'live' instance to confirm the vulnerability, you need to run against something you have legal access to. You can't just run against somebody else's instance - you need legally verifiable permission.
Sep 12	comment	Vulnerable java applications To be clear - the assumption is that if you're 'hunting in the wild', the 'preserve' is on a machine you have legal access to. If you start finding vulnerabilities for opensource projects by hunting in somebody else's preserve (that is, against a machine you don't have the legal right to access), the have every right to report you. Permission in writing is otherwise required.
Aug 3	comment	Securely tell the user his password in new WHM/Cpanel account creation? I'm assuming the difference between sending an expire-on-login password and a one-time-link is that the link can be used only once, and would have to be re-requested, whereas the user might decline to create a new password (forgoing the ability to use the site, but leaving the password eligible). Or have I missed something here?
Aug 1	awarded	Supporter
Jul 20	comment	How to store salt? Forgive my ignorance, but is it really necessary to hash the password before adding the salt? If you have a good hashing algorithm, it shouldn't make a difference, right?
Jul 13	awarded	Yearling
Jun 22	comment	Are online hash calculators dangerous? @GabrielFair - And how would you be getting the hash - have you hacked your back? (If so, salts are often stored with the password hashes). In general, I wouldn't expect a bank to provide extracts of hashes to anybody, as a security measure. If your bank has been hacked, and want to check against the 'released' list, change your password regardless, then compare the hashes.
Jun 22	comment	Are online hash calculators dangerous? This presumes a number of things (that banks are using SSL for one). Besides, just knowing that a password was used can be valuable - after a certain threshold, attempt to login at any local (given original requestor's IP address) (and possibly national) bank using the provided password and auto-generated names (say, names in the local phone book, or nabbed from facebook or something).
Jun 14	comment	Protection against DDoS when using proxies 6000 address making only a 'few' requests over a day, all on the same page? Maybe you have a bunch of readers for a daily webcomic that posts at an unknown time? It doesn't really sound like a deliberate attack per-se.
May 17	comment	I found that the company I work for is putting a backdoor into mobile phones Is there a use case for the software for situations where the legitimate user may not have control of the device? Say, is there 'wipe device' or 'hard-lock device' functionality? I don't imagine someone who stole the device is going to want to accept remote actions that render the device worthless.
Mar 5	awarded	Commentator
Mar 5	comment	How to protect data on your hard disk if it is in an unfriendly environment? Can you just generate an individual key for that particualr piece of hardware? Then if it gets stolen, revoke it's key. If all it does is connect to your server, you should be able to act as your own CA.
Feb 23	awarded	Nice Answer
Feb 1	comment	how to make software reverse engineering difficult Wait, scramble previous instructions? After they've been processed? And doesn't modern chip architecture/bios disable this type of behaviour at that level, to eliminate self-hiding viruses?
Jan 18	comment	SQL query sanitation (black list) There are a number of tokens on that list (notably, `CAST` and datatypes) which should be allowed, for a variety of reasons. Also, how were you planning on checking the statement for these tokens? Depending on your strategy, the check can either be bypassed, or return a false positive (like if someone has a column named `begin` that's a timestamp?). You've also eliminated the use of cursors, which are usually used to read data in blocks (a strategy for decreasing application access counts), which feels wrong.
Jan 18	comment	SQL query sanitation (black list) Because SQL tokens are case-insensitive, it's better to cast everything (including search strings, often) to a particular case, then check against the token in that case. If the database is going to convert things to a specific encoding, I'd attempt to do it at the application layer too, before casing/blacklisting, just in case.
Jan 18	comment	How to prevent cheating (extra votes) in online contests? This is also somewhat terrible from a database design point of view - It's much better to store a cross-ref table between user and answer. Data-set size is smaller, and it's much harder to 'forget' somebody (for example, a user who signed up after the user table was copied).
Jan 12	answered	How to prevent cheating (extra votes) in online contests?
Dec 8	comment	Wireless mouse security And even then, mostly mice report back relative movements (dx/dy), so if you're worried, just pick it up between movements, or run the cursor 'past' the edge (most OSes don't seem to let the cursor 'escape'). That'd probably limit them to detecting you clicking in the corners. Combine this with doing things like just clicking to focus the window, and keyboard shortcuts (from a wired keyboard), and you're good.