258 reputation
17
bio website ROCKYOU.fm
location Germany
age 26
visits member for 3 years, 5 months
seen Apr 17 at 9:57

M.Sc. (computer science) 😻 enthusiast programmer 😻 network administrator / developer in the GameSurge IRC network 😻 Gamer 😻 Concert photographer (mostly metal)


For anyone who considers looking for my email address and emailing me about his programming problem like this guy:

I just came across your profile on Stackoverflow. I hope this isn't
too intrusive but I desperately need some help with Python.
I'm new to programming and I'm currently trying to tackle two very
basic questions which I'm seriously struggling with.

NO, I will NOT help you in private. The fact that my website is not a programming site or personal blog should be reason enough for you not to use its contact form (or an email listed there) to contact "me".


Sep
11
revised XKCD #936: Short complex password, or long dictionary passphrase?
remove backtick abus
Sep
11
suggested suggested edit on XKCD #936: Short complex password, or long dictionary passphrase?
Aug
18
comment Is it safe to show user a message if account is locked
Throttling after a single failed password? That's pretty annoying for people who use a few passwords but don't remember which one they used. If you throttle after 5 bad passwords you still prevent brute force but legit attempts are likely to avoid throttling.
Aug
17
comment Proper storage/use of salted passwords?
There we go
Aug
17
answered Proper storage/use of salted passwords?
Aug
16
comment Proper storage/use of salted passwords?
Fyi, there are some rather common formats to store salted password hashes - usually they don't even need multiple database fields. Usually it's something like hash-type$salt$hash (look e.g. at the hash bcrypt gives you)
Jul
23
answered “Forgot my password page” best practice
Jul
16
comment Checking if TLS 1.1 and 1.2 implementation in a webserver is upto standards
If they implemented SSL on their own instead of using a well-tested library expect it to have security flaws and don't use it.
Nov
14
awarded  Commentator
Nov
14
comment How to restrict skype file transfer outside of LAN
Limited accounts for developers are a horrible idea...
Nov
14
comment How to restrict skype file transfer outside of LAN
Maybe you should start trusting your developers?! And that drag&drop failure is likely to be noticed quickly - maybe even before the other end accepted the transfer - or goes to someone with no malicious intent who won't spread the file.
Oct
25
comment How to encrypt database connection credentials on a web server?
That means the PHP code has access to everything needed to decrypt it. And that means any hacker with access to it can also retrieve the necessary information.
Oct
19
revised How to encrypt database connection credentials on a web server?
added 63 characters in body
Oct
19
comment How to encrypt database connection credentials on a web server?
Environment variables will not affect other processes which are not subprocesses of the current one. So you'd need to put this into apache itself. So why not simply put the environment variable in plaintext in the apache config which could have 600/root permissions.
Oct
18
answered How to encrypt database connection credentials on a web server?
Sep
28
awarded  Critic
Sep
5
comment Safe User Login Questions
True, in your case it might not be a huge issue, especially if the usernames are unknown, too - i mainly mentioned it for the sake of completeness.
Sep
5
comment Safe User Login Questions
I was talking about DoSing the user account - i.e. try logging in with multiple passwords to prevent the actual user from using his account.
Sep
5
comment Safe User Login Questions
DoS is always a problem if you have per-account logs after invalid logins. That's unrelated to any status code you return.
Sep
5
awarded  Yearling