883 reputation
414
bio website php100.wordpress.com
location San Jose, CA
age 39
visits member for 3 years, 4 months
seen 20 hours ago
Programmer (Unix, Windows, C, C++, PHP, etc.)

Dec
17
comment Store a password to avoid user interaction
Well, if you steal all OAuth keys then it doesn't matter really, whatever information you keep on the client side, if I create bit-by-bit copy of it I could use it the same way you do. However, OAuth does not send the keys out so it's more secure against stealing data in transit, replay attacks, etc.
Nov
14
comment Is it safe to allow untrusted field names in JSON?
If you're not evaluating JSON within Javascript eval() context, I don't see how these will matter - any name would be fine. If you do use this object inside JS context, then some names (like toString) might probably mess up the object's functionality, but if quoting is done properly I don't think you can do anything worse than that.
Aug
11
comment What is your way to create good passwords that can actually be remembered?
@Paulo That provided there are really sites that have humans ponder over each password entered there (out of hundreds of people signing up every day, probably) and guess the algorithm which is being used (and these humans are smart enough to guess it by just one instance). I think it's moderately safe to bet that chances of this happening are low. And if the site proves malicious the harm of giving them my email is probably worse - I get tons of trash from some sites that I signed up, found they are worthless and too lazy to find out how to delete my account.
Jul
24
comment SANS training - worth it?
@AviD As I said, I do not plan to specialize on infosec. I already have a job. I am hoping to upgrade and update my knowledge of security matters as it pertains to creating secure web applications. I am however not looking for certs and not looking for basic "what is XSS" type of courses, but rather in-depth stuff that would tell me something I didn't know before - new techniques, new threats, etc. So my question is are these ones worth it for expanding my knowledge - and maybe if not, what one would recommend instead.
Apr
19
comment MIME sniffing protection
Thanks, this paper looks very useful.
Feb
18
comment What is your way to create good passwords that can actually be remembered?
I tried this method for a while, but in 4-5 years you completely forget which line from which song you used for which place, and with special characters you may as well randomly generate it - you have no chance of remembering it. At least I don't. That's why I abandoned this method.
Jan
23
comment Is SSL key generation client-side, server-side, or both?
DH can be used as key exchange protocol, yes. Usually DH is used when there's no certificates in play and RSA if there are certificates. See httpd.apache.org/docs/2.0/ssl/ssl_intro.html
Jan
3
comment Is anybody using client browser certificates?
Almost nobody's using 2-factor auth either, but there at least I see the reason - distributing physical tokens has costs. Certs cost nothing though.
Jan
3
comment Is anybody using client browser certificates?
It doesn't have to be all-powerful - you can still ask for a password, for example. You can grant access to low-security areas with password alone and to high-security ones only with cert+password. That's just one model, of course.
Jan
3
comment Is anybody using client browser certificates?
I see your point, but that can be all done in the browser... The user should just download/double-click the file and that's it. Browser extensions are very complex things but were made seamless to the user, for example.
Dec
31
comment What is your way to create good passwords that can actually be remembered?
the problem with this method, once you forget was it "add @@ in the front, $$ in the back, shift 1 to the left and 2 down with wrap" or "add ## to the back, 12 at the front, shift 2 to the right with wrap and 1 down without wrap" you have a problem :) And sometimes you need passwords to places you last visited 4 years ago...
Dec
31
comment What prevents this exploit from working (unix SUID)?
Actually, you can set the SUID bit. You can't make it SUID to another user though, if you're not root.
Dec
31
comment Disable insecure/dangerous PHP functions
IMHO this is an exercise in futility. If somebody gains access to your system allowing him to run arbitrary PHP code on your system, disabling functions not going to help. There are dozens on functions not listed which can be used this way. Actually, this list makes zero sense - mysql_pconnect is there but mysql_connect and mysqli_connect are not.
Dec
29
comment Why do people say that PHP is inherently insecure?
@Ams of course there are (were) vulnerabilities, as in any other software big and popular enough. This however in no way means some "inherent insecurity".
Dec
25
comment Storing third-party auth info securely
There is a good reason. This is a service that users ask for, which works with their email data. I'm not sure I can reveal the details of what is done with the data, but they are mostly irrelevant - if you are concerned that the users don't know about what is involved, or somehow getting taken advantage of - it is not so. I'm not sure why you mention spam - it has absolutely nothing to do with spam.
Dec
25
comment Whitelisting DOM elements to defeat XSS
The same way - XSS site vulnerability. Imagine site that prints title (which is in the head section) according to user input and forgets to validate... Also, it may manipulate DOM to inject stuff into head section - so you'd have to introduce DOM permissions. And what if there's some vulnerable page that doesn't have <HEAD> elements at all - like one generating JSON? I could supply my own <HEAD> and thus break the protection.
Dec
24
comment Storing third-party auth info securely
honeypots isn't a bad idea, though it wouldn't help with the original problem.
Dec
24
comment Storing third-party auth info securely
The problem is it has to be persistent - i.e. the app should have access to the account in a week, month, etc. I.e. storing the key in memory wouldn't solve it - what if the server restarts, how would it decode the info then? Asking the user is not an option, that's the whole problem - the system should be independent once the user has registered the account.
Dec
24
comment Why do people say that PHP is inherently insecure?
This is untrue. PHP does have a lot of hacks, but it has nothing to do with insecurity. Any complex program has bugs, some of them would be security-related, so pointing to the list of bugs as proof of "inherent insecurity" is pointless and misleading.