network profile
| bio | website | bbc.co.uk/football |
|---|---|---|
| location | Sao Paulo, Brazil | |
| age | 31 | |
| visits | member for | 1 year, 6 months |
| seen | Apr 1 at 15:09 | |
| stats | profile views | 9 |
I'm a code and development enthusiast.
Cheers!
|
Mar 5 |
awarded | Popular Question |
|
Aug 22 |
awarded | Caucus |
|
Aug 22 |
awarded | Constituent |
|
Jun 8 |
comment |
Is my current method of handling session cookies insecure? @Yoaov, I've actually figured that part out already. It's just making sure it's secure. See accepted answer. Cheers! |
|
Jun 8 |
accepted | Is my current method of handling session cookies insecure? |
|
Jun 8 |
comment |
Is my current method of handling session cookies insecure? Wow, thank you for that thoughtful write up. This is great information! |
|
Jun 6 |
comment |
Is my current method of handling session cookies insecure? @Woot4Moo, I can't say I know the answer to that myself. Presumably difficult enough to deter would be attackers. My login system is borrowed from an authoritative reference that has been implemented and tested a plethora of times; and I followed to devotedly, until the issue of subdomains cropped up. |
|
Jun 6 |
comment |
Is my current method of handling session cookies insecure? @JeffFerland, Yes. I have that covered. Rails has a handy controller method called protect_from_forgery which inserts a random token. |
|
Jun 6 |
revised |
Is my current method of handling session cookies insecure? edited title |
|
Jun 6 |
revised |
Is my current method of handling session cookies insecure? deleted 1 characters in body |
|
Jun 6 |
revised |
Is my current method of handling session cookies insecure? added 56 characters in body; edited title |
|
Jun 6 |
asked | Is my current method of handling session cookies insecure? |
|
Dec 6 |
accepted | Is it safe to store the password hash in a cookie and use it for “remember-me” login? |
|
Dec 5 |
comment |
Is it safe to store the password hash in a cookie and use it for “remember-me” login? I don't understand something, perhaps this is another question in itself. Why does it matter if the userId is know? There are many sites where you can view people's ids by navigating to their profile page: *.com/users/123 -- doesn't that depend on the security of the application itself? Why do we need to encrypt a userId/hash when the id is readily available by visiting someone's profile? |
|
Dec 5 |
awarded | Editor |
|
Dec 5 |
revised |
Is it safe to store the password hash in a cookie and use it for “remember-me” login? added 4 characters in body |
|
Dec 5 |
comment |
Is it safe to store the password hash in a cookie and use it for “remember-me” login? Thanks for the info. I meant to say I use SHA-512, not MD5 for password encryption. |
|
Dec 5 |
asked | Is it safe to store the password hash in a cookie and use it for “remember-me” login? |
|
Nov 21 |
comment |
Best practices for email security @D.W. and Darthenius, how do you handle the UI side? If the user is viewing the account before the confirmation took place, do you show him the existing email address or the one pending update? Do you include a notice to say "x is pending update to y," etc... seems a bit quirky visualizing the whole process... |
|
Nov 20 |
awarded | Scholar |
