2,234 reputation
1917
bio website
location
age
visits member for 2 years, 7 months
seen 10 hours ago

Nov
7
comment Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
@Pacerier If only one client uses the same IP, you could use that to resurrect cookie. Of course, it isn't very efficient for Internet connexions with frequently changing IP.
Nov
7
comment Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
@Pacerier "Vidala Control Panel's "use new identity" is only about Tor exit point. Tor does not know or care about HTTP cookies, HTTP ETags, HTML5 Session Storage, Flash super cookies...
Nov
6
comment Is it safe to store and replay user-provided mime types?
@D.W. "it's easy" Pointing how easy something is is easy, but not very constructive. "I don't know how constructive or helpful that is if you don't have a viable solution" understanding the flaws of existing tools is IMO essential for protocols users and protocol designers (same with programming languages). I don't think that pointing out that I don't offer any solution is helpful or constructive.
Nov
6
comment Incorrect use of HTTPS?
"The certificate should either have a () or be a Wildcard" Is the use of *.example.com for example.com standard?
Nov
6
comment Incorrect use of HTTPS?
@TomHawtin-tackline "Really they should resolve to different IP addresses, and have everything sorted out with appropriate use of routers." www.example.com and example.com probably are the same site, why would you use two IP addresses? A certificate with both names should be fine.
Nov
6
comment Is it safe to store and replay user-provided mime types?
"Make sure that domain only hosts user-submitted content that is not security sensitive." then you cannot implement secure access control to these uploaded documents! Really, the H-couple (HTTP/HTML) sucks baldy. (I won't even mention the applet stuff.)
Nov
6
comment Is it safe to store and replay user-provided mime types?
@Piskvor "It is not safe. Allowing the user to specify the MIME type and the contents of the file is a self-inflicted XSS hole." "This is a flaw in HTTP." "How exactly would you suggest to fix that?" with a new header to indicate the access rights of the content. Of course, if you change HTTP version 1, you have the issue of existing HTTP clients. The solution should be failsafe for existing clients that don't know the new header. OTOH, if you change HTTP major version, you do not have this problem.
Nov
6
comment Is it safe to store and replay user-provided mime types?
"you're exposing your users to would be to upload text/html file with arbitrary Javascript code e.g. in elements." Your link gives an HTML5 fix to that text/html-sandboxed, but it is ad hoc and thus ugly. What about Java applets? Flash objects? A generic and fail-safe approach is wanted! Something like "Content-Type: untrusted/what/ever" (f.ex. Content-Type: untrusted/text/html, Content-Type: untrusted/application/x-shockwave-flash).
Nov
5
comment How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
@starblue "changing the password twice in a row." can be defeated by enforcing a minimum time between changes. (Something I do not recommend.)
Nov
4
comment Does the SSL encryption strength of a website really matter?
"Is it ironic that you posted this a day after a known-plaintext attack against TLS 1.0 was demonstrated?" Has this attack been tried against anyone in the real world?
Nov
4
comment Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
"Because browsers do content-sniffing" My gut feeling is that you should serve sniffable content, test if the content has been sniffed, then block access from these hopelessly broken browsers. (But my gut feelings may not be very practical.)
Nov
4
comment Is it safe to store and replay user-provided mime types?
reworded comment: "Allowing the user to specify the MIME type and the contents of the file is a self-inflicted XSS hole." Well, it should not be. This is a flaw in HTTP.
Nov
4
comment Is it safe to store and replay user-provided mime types?
"It is not safe." Well, it should be. This is a flaw in HTTP.
Nov
4
comment Is it safe to store and replay user-provided mime types?
The additional question is: how to tell HTTP clients that the MIME-type is untrusted?
Nov
4
comment Is it safe to store and replay user-provided mime types?
I don't think he mentioned lawyers.
Nov
4
comment https security - should password be hashed server-side or client-side?
@symcbean What do you mean by "secure"?
Nov
4
comment https security - should password be hashed server-side or client-side?
"if your hashing logic is client-side you're exposing it." so what?
Nov
4
comment https security - should password be hashed server-side or client-side?
@johndodo "the only advantage to using hashed passwords is protecting users' accounts on other websites in case the passwords / hashed passwords are stolen" Not only one reason. But still, it is one reason.
Nov
4
comment Are WPA2 connections with a shared key secure?
"Diffie-Helman key exchange" Really?
Nov
2
comment How can I ensure that I connect to the right wireless Access Point?
"The main problem is that the control data in 802.11x is never encrypted. Because every wireless authentication must start using the unencrypted control sequence, it will be vulnerable to a man-in-the-middle attack." The main problem with whatever is that the initial control data in whatever is never encrypted. Because every whatever authentication must start using the unencrypted control sequence, it will be vulnerable to a man-in-the-middle attack.