918 reputation
716
bio website php100.wordpress.com
location San Jose, CA
age 40
visits member for 4 years
seen Dec 4 at 22:16
Programmer (Unix, Windows, C, C++, PHP, etc.)

Jun
10
comment What are the implications of NSA surveillance on the average internet user?
There's actually more than two stories. E.g. story about IRS considering every mailbox public information not requiring a warrant: aclu.org/blog/technology-and-liberty-national-security/…
May
26
awarded  Popular Question
Dec
11
awarded  Yearling
Sep
26
awarded  Popular Question
Jul
30
answered “Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?
Jul
7
comment Are there vunerabilities with this authentication mechanism?
@curiousguy I think many protocols that ignore invalid data and do not cancel communication when getting some invalid data would not be susceptible o this particular problem.
Jul
6
comment Are there vunerabilities with this authentication mechanism?
Checking if request token was authorized doesn't help, because attacker could after observing step 2 disrupt communication with the client (e.g. by some kind of network attack slowing down client's network) and issue his own response with the timestamp first. If you allow only one response with this timestamp, you then allow very easy DOS attack on the protocol - I can prevent any client from logging in as long as I can send response faster than they do. If you allow many responses with the same timestamp, I can bruteforce it.
May
9
comment Hiding version - valuable or just security by obscurity?
you can, never saw that done in practice though.
May
9
comment Hiding version - valuable or just security by obscurity?
but if you have a set of exploits, why wouldn't you just launch all of them? It'll take you probably 5-10 seconds for all (99% of exploits take one request to execute), why rely on version and limit your potential list? Are there any data that point attackers really rely on versions in the field? I regularly have ancient exploits tried on my servers, but this of course is anecdotal.
May
8
comment Hiding version - valuable or just security by obscurity?
As I said, one of the reasons to expose it may be so you could have automated tools to inventory your systems and alert you about old versions being left behind. So there are reasons :) What I'm asking is why everybody places this on the vulnerabilities lists together with real issues (like XSS, XSRF, etc.) as if it by itself could have any influence on your security.
May
8
comment Hiding version - valuable or just security by obscurity?
You can easily recognize app powered by Wordpress without needing any "powered by" - Wordpress has very specific structure of URLs, probably indexed by Google: wp-content, wp-includes, wp-login, etc.
May
7
asked Hiding version - valuable or just security by obscurity?
Mar
20
comment Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
I think that greatly depends on the sentences that the ones that were recently caught get. It's one thing to wreak havoc knowing that nobody will ever get to you, another knowing the end of the road is 15 years in federal prison...
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@HughAllen consider also that there were cases of US government taking over .com domains of entities outside US which violated US laws. So having .com site and committing a felony in the US is usually not a very smart move for an entity whose business is entirely web-based.
Jan
17
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
@TomLeek sorry, I don't see how that makes sense - you can run bare SQL in any language that supports direct DB query (which is all of them that support connecting to DB). Security practices are well-known and are the same for PHP as for any other language. There's no such thing as "PHP record" because each software is written in a different way by different people. It's like saying electricity is bad because all computers that were hacked used electricity. It's just FUD stemming from repeating third-party misinformation without bothering to check the actual facts.
Jan
17
awarded  Critic
Jan
17
comment Can one get infected through visiting a site with a PHP script on it and if yes, how?
The fact that the server code may be written in PHP has absolutely nothing to do with it being cautiously or incautiously written, which of course does not prevent one from baselessly bashing PHP.
Dec
17
comment Store a password to avoid user interaction
Well, if you steal all OAuth keys then it doesn't matter really, whatever information you keep on the client side, if I create bit-by-bit copy of it I could use it the same way you do. However, OAuth does not send the keys out so it's more secure against stealing data in transit, replay attacks, etc.
Dec
16
answered Store a password to avoid user interaction
Dec
11
awarded  Yearling