324 reputation
19
bio website slhck.info
location Berlin, Germany
age
visits member for 3 years, 9 months
seen Aug 6 at 11:07

I'm a former community-elected Super User moderator.

I offer personal consulting and help with video encoding, especially with FFmpeg. Write a mail to slhck at me.com to get in touch.

profile for slhck on Stack Exchange, a network of free, community-driven Q&A sites


Apr
13
comment What to do about websites that store plain text passwords
"The first step is to find proof, such as by running Wireshark to capture the passwords as they are sent on the wire." — that won't prove anything. To sign up and log in, you obviously have to send your plaintext password to their servers. How else could the server process the password and authenticate you? The real problem is passwords being stored as plaintext in a database.
Sep
24
awarded  Autobiographer
Mar
12
comment Why is Windows auditing svchost by default?
Moved on request of the OP.
Dec
22
comment Is Chrome in Metro Mode more secure than Chrome in Desktop Mode?
Can you explain what a cluster of cookies is, why they'd be harmful, and why Chrome as a "Metro" app would reduce the number of cookies? What does "linked together" refer to? Generally it would be good to back up your answer with references or details to support your claims.
Jul
27
awarded  Critic
Apr
17
comment Authentication concept for sites served to another site
In the 3-legged OAuth scheme, I take it we are the service provider and the consumer is the CMS. However, this requires the user to actively log in at the service provider, which authenticates the user. This is not possible in our case—the user will authenticate against the CMS first. Or am I missing something?
Apr
17
comment Authentication concept for sites served to another site
@SébastienRenauld We only supply pages that are loaded in an iframe, that's it. Could you elaborate on how that would work? The customer has to log in at the CMS – then the CMS can request almost anything from us, but it has to be via GET.
Apr
17
comment Authentication concept for sites served to another site
We might be able to use HTTPS for all communication. POST is out of the question because we're literally just embedding the content into an iframe, like in the URL example above. Maybe we could authenticate once via POST and then through our backend store… a cookie? Would that cookie work even though we're accessing within an iframe?
Apr
17
revised Authentication concept for sites served to another site
added 23 characters in body
Apr
17
awarded  Student
Apr
17
asked Authentication concept for sites served to another site
Feb
23
awarded  Citizen Patrol
Nov
12
awarded  Yearling
Oct
14
awarded  Editor
Oct
14
awarded  Excavator
Oct
14
revised Who (which process) is calling curl?
typo "culr_ppid" » "curl_ppid"
Oct
14
suggested approved edit on Who (which process) is calling curl?
Mar
11
awarded  Supporter
Feb
22
awarded  Nice Answer
Dec
15
comment How to scan Javascript for malicious code?
I don't think this is as easy as you believe it is. Javascript can't do anything malicious by itself and there's no "virus" to be detected. Javascript is the primary vector for Cross Site Scripting attacks, but it would be better to secure your webapp against this rather than to trust extensions. It's your webapp that's vulnerable and you'd need a good understanding of the webapp in order to analyze extensions for their security.