19,964 reputation
453102
bio website faiumoni.de/de/start.html
location Germany, Europe
age 34
visits member for 4 years, 7 months
seen Jun 10 at 10:01

My main focus is on security and privacy aspects in the areas of business web applications, databases and online games. I like to look further and see the whole picture.


Jul
3
comment Is it a bad idea for an information holder to e-mail a user their password?
[Hendrik tries hard to stop giggling...]
Jul
3
revised Webserver logs show someone is trying to hack my site, what should I do?
edited tags
Jul
3
answered Webserver logs show someone is trying to hack my site, what should I do?
Jul
3
revised Is it a bad idea for an information holder to e-mail a user their password?
edited tags
Jul
3
answered Is it a bad idea for an information holder to e-mail a user their password?
Jul
3
awarded  Disciplined
Jul
2
revised Secure jquery ajax calls from a non secure page
use official example domain instead of advertisting
Jul
2
answered Secure jquery ajax calls from a non secure page
Jul
2
comment Solution to allow JavaScript input but prevent XSS
As D.W. said this gets really complex and wildcard certificates, that are required to isolate one untrusted JavaScript code from another untrusted JavaScript code, are quite expensive. On a small site it is unlikely that you will make enough money with advertisement to recover those costs. So you should think in detail about whether arbitrary JavaScript code is really, really needed.
Jul
2
comment Solution to allow JavaScript input but prevent XSS
@D.W., no, I have not missed that part of the question. But I looked at the reasoning he gave for that statement and provided an answer for that instead. The idea is NOT to put the JavaScript into an div. The div only contains information that is interpreted by trusted JavaScript provided by the site owner. As I said, this does not give authors the full power of JavaScript, but it can be used for all common use cases, such as embedding known addvertisment systems.
Jul
1
comment Deploying a campus WiFi network that authenticates against an AD LDAP
In the context of wireless authenticating users on campus, Eduroam may be interesting, especially the documentation
Jul
1
comment How can I avoid sending passwords in plain text when logging into a website?
yes, if you can trick a user into using http instead of the default https for the login (e. g. if he goes to the http version of the start page and you manipulate the login form not to point to https://www.facebook.com/login.php?login_attempt=1)
Jul
1
answered How can I avoid sending passwords in plain text when logging into a website?
Jun
30
revised Solution to allow JavaScript input but prevent XSS
edited title
Jun
30
revised Solution to allow JavaScript input but prevent XSS
html escaping of sample code
Jun
30
revised Solution to allow JavaScript input but prevent XSS
edited body
Jun
30
answered Solution to allow JavaScript input but prevent XSS
Jun
28
comment Email Spoofed. Explain?
There is way to little information in your question to give a detailed answer. What is the domain part of your email-address? What is the domain part of the target's email addres? Is that the complete header? Especially are there more Received/To/From/Date lines? Was 216.212.117.146 your IP-address? Was the private subject line something you have used or something made up by the sender of that email? Do you use an email client or the google webinterface to normally send email?
Jun
28
revised Email Spoofed. Explain?
edited tags; edited title
Jun
27
revised windows wiki excerpt
added 62 characters in body