294 reputation
bio website slhck.info
location Berlin, Germany
visits member for 3 years, 6 months
seen May 22 at 17:33

I'm a…

  • ♦ moderator on Super User
  • researcher at the Telekom Innovation Laboratories of Deutsche Telekom AG, Germany, where I research Quality of Experience for video applications
  • software developer with a focus on web stuff

If you have any questions about moderation, feel free to ping me in the Ask a Super User moderator chat room. For everything else, don't hesitate to write me a mail to slhck at me.com.

profile for slhck on Stack Exchange, a network of free, community-driven Q&A sites

comment What to do about websites that store plain text passwords
"The first step is to find proof, such as by running Wireshark to capture the passwords as they are sent on the wire." — that won't prove anything. To sign up and log in, you obviously have to send your plaintext password to their servers. How else could the server process the password and authenticate you? The real problem is passwords being stored as plaintext in a database.
comment Why is Windows auditing svchost by default?
Moved on request of the OP.
comment Is Chrome in Metro Mode more secure than Chrome in Desktop Mode?
Can you explain what a cluster of cookies is, why they'd be harmful, and why Chrome as a "Metro" app would reduce the number of cookies? What does "linked together" refer to? Generally it would be good to back up your answer with references or details to support your claims.
comment Authentication concept for sites served to another site
In the 3-legged OAuth scheme, I take it we are the service provider and the consumer is the CMS. However, this requires the user to actively log in at the service provider, which authenticates the user. This is not possible in our case—the user will authenticate against the CMS first. Or am I missing something?
comment Authentication concept for sites served to another site
@SébastienRenauld We only supply pages that are loaded in an iframe, that's it. Could you elaborate on how that would work? The customer has to log in at the CMS – then the CMS can request almost anything from us, but it has to be via GET.
comment Authentication concept for sites served to another site
We might be able to use HTTPS for all communication. POST is out of the question because we're literally just embedding the content into an iframe, like in the URL example above. Maybe we could authenticate once via POST and then through our backend store… a cookie? Would that cookie work even though we're accessing within an iframe?
comment How to scan Javascript for malicious code?
I don't think this is as easy as you believe it is. Javascript can't do anything malicious by itself and there's no "virus" to be detected. Javascript is the primary vector for Cross Site Scripting attacks, but it would be better to secure your webapp against this rather than to trust extensions. It's your webapp that's vulnerable and you'd need a good understanding of the webapp in order to analyze extensions for their security.