1,232 reputation
38
bio website shivampatel.net
location New York, United States
age
visits member for 2 years, 3 months
seen Apr 6 at 5:01

I code! Do you?


Sep
26
comment Why does everyone require certain password characters now?
Well I understand that salts are NOT a secret and they are stored in plain text. Afterall, you need to store the salt (or the pepper) to validate the password. All I am trying to say is a scenario where an attacker just manages to get the hashes (as against a full database table). In such a case, he has two things to brute force - the password as well as the salt. Now in this case if a very easy password like 'password' helps in revealing that the salt is probably a 2 character string, then attacker has a definite advantage for cracking the rest of the passwords. Isn't it ?
Sep
25
comment Why does everyone require certain password characters now?
Well I meant what if you only have hashes. What do you do to crack the password then. Brute force password and brute force salt, isn't it ? In such an approach what if you find out that the salt is only a 2 character string !! Does it not make your job easier ?
Oct
17
comment Is it safe to store twitter access tokens client side?
did you mean access_token_key and access_token_secret ?
Oct
8
comment How to disable caching of form data?
+1 Glad this question was asked. Reposting login creds on page refresh just renders the entire authentication system broken.
Sep
14
comment anonymization for scanning and hacking
@D.W. Thanks for rewording. I realize that the original verbiage was indeed suggesting that I am asking him to do it that way. Cheers!!
Sep
14
comment anonymization for scanning and hacking
I just answered the question from a technical perspective. I am just assuming and hoping that someone is not naive enough do these kinds of disruptive things. Forget Tor, the idea of scanning/exploiting some resource without prior permission and consent from the owner is in itself a very bad idea and should be totally discouraged. So I totally agree with @D.W.
Sep
11
comment Facebook API : App Secret - possible misuse
@D.W. Yes, that is correct. In such a case the server is proxying on behalf of the client for the OAuth steps. This then becomes similar to the browser(client) - server - facebook model. I am editing my answer to include that.
Sep
10
comment Protecting against CSRF when a form is being submitted via an AJAX call
Yeah, you are right. I misinterpreted the question. My bad. Gaurav, in case you are not able to send cookies in AJAX requests, one way out could be to have the token appended in the querystring of the URL, eg: example.com/createuser.php?token=<token>; The script createuser.php will then compare the $_GET['token'] and $_POST['token_hidden_form_field'] and proceed if they match. In this scheme, if a attacker manages to POST a form, he'd still need to know the correct querystring parameter 'token'.
Jul
14
comment Is this password hashing method secure?
+1 To bring out the point that collisions are bad because multiple passwords will be accepted as correct
Jul
13
comment How can I identify that my page is requested by robot, but not user's browser?
When we say hidden links, do we mean links on foreground color = background color ?
Jul
11
comment How to destroy old credit card?
oh sure, I can take care of that. Send it to my address :) :)
Jul
11
comment buffer/heap overflow - register of what is executed
I look at a question and say 'eh, can't write all that'. Come back again in a hour and say 'eh, let me write a quick 1 liner'... an hour later its no longer a 'one liner'. I am sure SE does this to so many people every day :|
Jul
8
comment How to secure the connection between the proxy and application
Where does the application live? What is outside world ? Internet ? What do you mean by: "The connection between proxy and the application is encrypted using SSL. But the connection between the application and proxy is NOT encrypted"
Jul
7
comment Can voice chat be spied?
I'd like to know what parts are untrue and why so. When I said chat softwares are peer-to-peer, I said in the context of video/audio chat. Text based chat is still routed through servers but most video/audio chat is done peer-to-peer by the clients. Also why would a client certificate be insufficient to authenticate a chat client to other. Kindly elaborate.
Jul
6
comment Identify an HTTP scanner from some HTTP headers
Well again, someone might have configured it to try different user-agents while keeping the other headers constant. One could just be using wget in loop, who knows !! $ wget --header='Accept: */*' --header='Accept-Language: en-us' --header='Accept-Encoding: gzip, deflate' --header='Connection: Close' http://localhost If you are looking for an scanner that in its default setting sends these headers, there could be more than one - given these are such a general header values.
May
16
comment Where is cross-site scripting code processed?
Thats a good link. Though I don't know why you'd ask to read all that just to understand how XSS works !
Feb
28
comment How to keep secure while browsing on open wifi when SSL VPN is blocked?
If tunneling over SSH is an option, thats a very good way to protect your session. Any reason you are looking for options other than that ?
Feb
23
comment Securing data transfer between public network and personal accounts
I'd however bring this point here. The SSH fingerprint that any SSH client asks you to accept authenticates your server. Hence, you should only accept keys after verifying if you are truly paranoid. What I'd do is that I'd connect to the SSH server form my home network once (when I know there is no MITM going on). It saves the key for future connections thereafter. At this point, I have reasons to be alarmed if the same ssh client asks me to verify a new fingerprint sometime in future. 2 reasons it can happen is - 1.) SSH server got restarted. 2.) you are being MITMed.
Feb
23
comment Securing data transfer between public network and personal accounts
If you meant the possibility of sniffing your data (which is essentially your ssh creds) while your are connecting to the ssh server, then the answer is NO. Thats because your credentials are transferred only after the ssl (yeah ssh is ssl under the hood) has been established.<br/> So everything that goes over the proxy after that cannot be sniffed.<br/>
Feb
22
comment Securing data transfer between public network and personal accounts
+1 For being concerned to do the right thing, as against falling for the wicked firesheep