Reputation
526
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 3 16
Impact
~26k people reached

Feb
5
comment What is the best way to store password in memory (RAM) in Java?
The only problem with this method is that I have yet to meet a java web application container that doesn't default to sending parameters over as Strings in the first place. This means your cleartext password will sit in memory until the string pool is finally collected. If your JVM is < 1.7 it'll be in permgen space.
Oct
20
awarded  Popular Question
Oct
1
comment Better techniques than url parameter encryption
What we ended up doing is creating a SecureRandom AES key on login, and we encrypted the parameters throughout the session. This prevented URL parameter manipulation, but then introduced the problem that all sales IDs became ephemeral, so you couldn't permalink or bookmark. It was a learning experience, both the question and the project. Few things that happened I would do now.
Oct
1
comment Better techniques than url parameter encryption
At the time the question was asked, https wasn't an issue--it was used. We weren't worried about MiTM, we were worried about a sales agent being able to look at the quotes of people not on his team... classic parameter manipulation, with the constraint of no RBAC. Your solution here would still be vulnerable, as user1 could grab zXTcxOo8QU and look at user's quotes. [Note, database lookups could be used to fix this as well.]
Aug
19
awarded  Popular Question
May
11
awarded  Quorum
Apr
29
awarded  Informed
Apr
25
answered VM production server and low entropy
Apr
9
comment Static code review approach
It's been almost a year. Can you select an answer?
Mar
25
awarded  Famous Question
Feb
19
comment How is it possible to embed executable code in an image
+1: thanks Microsoft! && Because Windows!
Jan
29
comment Understanding Java Security Providers
@dave_thompson_085 You are correct. I deleted my answers to questions 2 and 3 and directed readers to your answer. (I was really hoping to prod any kind of an answer here after two months...)
Jan
29
revised Understanding Java Security Providers
removed the blatantly incorrect portion of my answer and ceded to the better one.
Jan
28
answered Can a Java servlet filter be used to pull out scripts that aren't whitelisted?
Jan
28
answered Understanding Java Security Providers
Jan
2
awarded  Curious
Oct
27
comment Solution to allow JavaScript input but prevent XSS
+1 for showing one of the most non-obfuscated but still obfuscated XSS attacks I've ever seen.
Oct
27
comment Solution to allow JavaScript input but prevent XSS
Actually you have an auditing issue that @jrwren really opens right up for you. At a bare minimum, you're going to want some kind of versioning on any source code that a user submits and that you store. If you don't, and say that code IS used to launch attacks--you will at least be able to say when that piece of code was added, and be able to roll back to a known "good" state.
Oct
22
accepted How negative are virtual machines (vms) to /dev/urandom?
Oct
17
comment How negative are virtual machines (vms) to /dev/urandom?
So in answering the concrete question, "How badly does moving to a virtual machine harm entropy?" Its essentially subjective due to the total # of possible bits we lose in the move?