StasM

823 reputation

212

bio	website	php100.wordpress.com
	location	San Jose, CA
	age	38
visits	member for	2 years, 5 months
	seen	Mar 31 at 7:43
stats	profile views	31

Programmer (Unix, Windows, C, C++, PHP, etc.)

	823 reputation	bio	website	php100.wordpress.com	visits	member for	2 years, 5 months
212 badges		location	San Jose, CA		seen	Mar 31 at 7:43

summary answers questions tags badges favorites bounties reputation activity

29 Comments

suggestions reviews revisions comments badges posts accepts all

Jul 7	comment	Are there vunerabilities with this authentication mechanism? @curiousguy I think many protocols that ignore invalid data and do not cancel communication when getting some invalid data would not be susceptible o this particular problem.
Jul 6	comment	Are there vunerabilities with this authentication mechanism? Checking if request token was authorized doesn't help, because attacker could after observing step 2 disrupt communication with the client (e.g. by some kind of network attack slowing down client's network) and issue his own response with the timestamp first. If you allow only one response with this timestamp, you then allow very easy DOS attack on the protocol - I can prevent any client from logging in as long as I can send response faster than they do. If you allow many responses with the same timestamp, I can bruteforce it.
May 9	comment	Hiding version - valuable or just security by obscurity? you can, never saw that done in practice though.
May 9	comment	Hiding version - valuable or just security by obscurity? but if you have a set of exploits, why wouldn't you just launch all of them? It'll take you probably 5-10 seconds for all (99% of exploits take one request to execute), why rely on version and limit your potential list? Are there any data that point attackers really rely on versions in the field? I regularly have ancient exploits tried on my servers, but this of course is anecdotal.
May 8	comment	Hiding version - valuable or just security by obscurity? As I said, one of the reasons to expose it may be so you could have automated tools to inventory your systems and alert you about old versions being left behind. So there are reasons :) What I'm asking is why everybody places this on the vulnerabilities lists together with real issues (like XSS, XSRF, etc.) as if it by itself could have any influence on your security.
May 8	comment	Hiding version - valuable or just security by obscurity? You can easily recognize app powered by Wordpress without needing any "powered by" - Wordpress has very specific structure of URLs, probably indexed by Google: wp-content, wp-includes, wp-login, etc.
Mar 20	comment	Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)? I think that greatly depends on the sentences that the ones that were recently caught get. It's one thing to wreak havoc knowing that nobody will ever get to you, another knowing the end of the road is 15 years in federal prison...
Mar 14	comment	Why would someone trust DuckDuckGo or other providers with a similar privacy policy? @HughAllen consider also that there were cases of US government taking over .com domains of entities outside US which violated US laws. So having .com site and committing a felony in the US is usually not a very smart move for an entity whose business is entirely web-based.
Jan 17	comment	Can one get infected through visiting a site with a PHP script on it and if yes, how? @TomLeek sorry, I don't see how that makes sense - you can run bare SQL in any language that supports direct DB query (which is all of them that support connecting to DB). Security practices are well-known and are the same for PHP as for any other language. There's no such thing as "PHP record" because each software is written in a different way by different people. It's like saying electricity is bad because all computers that were hacked used electricity. It's just FUD stemming from repeating third-party misinformation without bothering to check the actual facts.
Jan 17	comment	Can one get infected through visiting a site with a PHP script on it and if yes, how? The fact that the server code may be written in PHP has absolutely nothing to do with it being cautiously or incautiously written, which of course does not prevent one from baselessly bashing PHP.
Dec 17	comment	Store a password to avoid user interaction Well, if you steal all OAuth keys then it doesn't matter really, whatever information you keep on the client side, if I create bit-by-bit copy of it I could use it the same way you do. However, OAuth does not send the keys out so it's more secure against stealing data in transit, replay attacks, etc.
Nov 14	comment	Is it safe to allow untrusted field names in JSON? If you're not evaluating JSON within Javascript eval() context, I don't see how these will matter - any name would be fine. If you do use this object inside JS context, then some names (like toString) might probably mess up the object's functionality, but if quoting is done properly I don't think you can do anything worse than that.
Aug 11	comment	What is your way to create good passwords that can actually be remembered? @Paulo That provided there are really sites that have humans ponder over each password entered there (out of hundreds of people signing up every day, probably) and guess the algorithm which is being used (and these humans are smart enough to guess it by just one instance). I think it's moderately safe to bet that chances of this happening are low. And if the site proves malicious the harm of giving them my email is probably worse - I get tons of trash from some sites that I signed up, found they are worthless and too lazy to find out how to delete my account.
Jul 24	comment	SANS training - worth it? @AviD As I said, I do not plan to specialize on infosec. I already have a job. I am hoping to upgrade and update my knowledge of security matters as it pertains to creating secure web applications. I am however not looking for certs and not looking for basic "what is XSS" type of courses, but rather in-depth stuff that would tell me something I didn't know before - new techniques, new threats, etc. So my question is are these ones worth it for expanding my knowledge - and maybe if not, what one would recommend instead.
Apr 19	comment	MIME sniffing protection Thanks, this paper looks very useful.
Feb 18	comment	What is your way to create good passwords that can actually be remembered? I tried this method for a while, but in 4-5 years you completely forget which line from which song you used for which place, and with special characters you may as well randomly generate it - you have no chance of remembering it. At least I don't. That's why I abandoned this method.
Jan 23	comment	Is SSL key generation client-side, server-side, or both? DH can be used as key exchange protocol, yes. Usually DH is used when there's no certificates in play and RSA if there are certificates. See httpd.apache.org/docs/2.0/ssl/ssl_intro.html
Jan 3	comment	Is anybody using client browser certificates? Almost nobody's using 2-factor auth either, but there at least I see the reason - distributing physical tokens has costs. Certs cost nothing though.
Jan 3	comment	Is anybody using client browser certificates? It doesn't have to be all-powerful - you can still ask for a password, for example. You can grant access to low-security areas with password alone and to high-security ones only with cert+password. That's just one model, of course.
Jan 3	comment	Is anybody using client browser certificates? I see your point, but that can be all done in the browser... The user should just download/double-click the file and that's it. Browser extensions are very complex things but were made seamless to the user, for example.