18,062 reputation
34695
bio website faiumoni.de/de/start.html
location Germany, Europe
age 33
visits member for 3 years, 7 months
seen Jun 12 at 12:53

My main focus is on security and privacy aspects in the areas of business web applications, databases and online games. I like to look further and see the whole picture.


Apr
7
comment Using same CSRF Token for Multiple account creation
@Xander, depending on the situation this may be an issue because the IP-address in the server log files will not point to the attacker but to the victim. This is assuming that the CSRF token is not logged. For example an attacker is able to frame a victim by letting his browser create an account and access some illegal information (e. g. copyright violation or worse).
Feb
19
comment Is 'Forge' Javascript crypto library secure?
@FrancisSnipe, keep in mind that you need a secure way (e. g. https) to transmit the html and javascript code to the client. Otherwise an attacker can add some code to send a copy of the unencrypted data elsewhere.
Feb
8
comment Can you generate Diffie-Hellman parameters quickly
Crypto.SE does not want questions about programming. I suspect there is an issue with the random number source.
Dec
20
comment How to stay anonymous in public wireless network?
Google cookies and the unique identifier used by e. g. Firefox to download the list of malicious sites in segments are further identifiers.
Nov
3
comment What's the difference between SSL, TLS, and HTTPS?
@thejh, oops, good catch.
Oct
16
comment Can we make sure that the new Lavabit certificate is not under control of the FBI?
This reminds me of an old movie in which the terrorist holds a gun towards the head of the president's daughter behind the camera.
Sep
5
comment Is there a way to block Ultrasurf OR can I have McAfee nuke it?
Hello Monsuco and welcome to Security.SE. Unfortunately it almost impossible to protect computers to which adversaries have physical access to. Furthermore, your adversaries have a lot of time, motivation and probably technology skills. I suggest to approach this issue from a social angle: Create a set of rules for acceptable use of school property with realistic (!) consequences for concrete types of misuse.
Aug
14
comment Wildcard SSL Certificates & SAAS
Related: What vulnerabilities could be caused by a wildcard SSL cert?
Aug
9
comment LDAP vs MySQL for Usernames and Passwords
One very common mistake with authenticating against an LDAP server is not paying attention to anonymous binds. Many LDAP servers return success on an authentication attempt with an empty password, regardless of the username.
Jul
23
comment What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?
Mr. Alien, I think this is a very valid question and therefore I prefer not to delete it. I removed the reference to a hash-function which is not suitable for hashing password. This may be one of the reasons for the downvotes. Please have a look at security.stackexchange.com/q/15910/665 regarding password hashing algorithms.
Jul
6
comment Block all kind of querys from ip
It may be a good idea to let the switches do this work because they know if there is a device connected and what mac address it has.
Jun
28
comment Response to script-kiddies “scanning” website for vulnerabilities?
Not all of those are actively done by people, but by worms trying to spread themselves.
Jun
26
comment XSS prevention through Content Security Policy
CSP was designed to allow trusted JavaScript not to forbid JavaScript entirely. If you stick with modern best practices (e. g. no intervening of JS and HTML), very little or even no changes are required.
Jun
12
comment When to use SSL ? / When to send passwords via mail?
You can get SSL certificates, that are accepted by all common browsers, free of charge.
May
23
comment Insecure versions of crypt hashes
@Shackrock $6 is Sha512Crypt. That is an algorithm that is similar to BCrypt, but different. Most notably, it is based on Sha512 instead of Blowfish.
Apr
8
comment Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
Possible Duplicate: security.stackexchange.com/q/32361/665
Apr
6
comment Server root attack?
This looks like an attempt to exploit registerglobals
Apr
6
comment Getting credentials using proxy server
Possible duplicate of security.stackexchange.com/questions/2914
Mar
21
comment Is it possible to execute a php script in an image file?
Please note Apache's support for double extensions: something.php.gif will be handled by PHP in common installations despite the final extension being .gif.
Mar
18
comment How would one crack a weak but unknown encryption protocol?
Hello RamRachum, Challenge to decode something style-questions are considered off topic here.