meta user
network profile
| bio | website | podlipensky.com |
|---|---|---|
| location | San Francisco, CA | |
| age | ||
| visits | member for | 1 year, 4 months |
| seen | yesterday | |
| stats | profile views | 29 |
|
1d |
asked | IMG tag vulnerability |
|
May 3 |
awarded | Good Question |
|
Jan 10 |
awarded | Yearling |
|
Dec 14 |
awarded | Notable Question |
|
Sep 21 |
awarded | Custodian |
|
Aug 14 |
awarded | Caucus |
|
Jul 31 |
accepted | Workarounds for :visited CSS History reconnaissance |
|
Jul 31 |
asked | Workarounds for :visited CSS History reconnaissance |
|
Jul 26 |
accepted | How to detect cookie stuffing attacks? |
|
Jul 25 |
comment |
How to detect cookie stuffing attacks? @AndrewSmith my business model is similar to Amazon - I have partners which produce some traffic to my website and in case of user's purchase I pay them money. So, any ideas how to protect it? |
|
Jul 25 |
reviewed | Approve suggested edit on How to detect cookie stuffing attacks? |
|
Jul 25 |
asked | How to detect cookie stuffing attacks? |
|
Jul 24 |
answered | What are the biggest unsolved problems in IT Security? |
|
Jul 24 |
answered | Clickjacking: can't browsers just forbid/reject placing transparent elements over frames? |
|
Jul 24 |
comment |
How to protect against clickjacking attack but allow legit iframes? I wrote small clickjacking techniques overview as well as defense options: podlipensky.com/2012/07/clickjacking-explained |
|
Jul 21 |
accepted | How to protect against clickjacking attack but allow legit iframes? |
|
Jul 19 |
comment |
How to protect against clickjacking attack but allow legit iframes? Are you aware of any such automated scripts? What exactly do they check on the page? Do they emulate user's mouse and behavior? I think publisher could implement bot-detection logic and prevent the script to figure out any problems on the page... |
|
Jul 19 |
comment |
How to protect against clickjacking attack but allow legit iframes? You mean that I have to manually go to website, try to click somewhere and figure out that the request is clickjacked? Doesn't sound like a good solution... In the wild such publishers may register thousand websites a day, there is no way to check all of them manually! |
|
Jul 19 |
comment |
How to protect against clickjacking attack but allow legit iframes? What exactly in my log will tell me about clickjacking request? |
|
Jul 19 |
comment |
How to protect against clickjacking attack but allow legit iframes? I got idea about tokens, but still can't understand how to detect clickjacking in first place. Let's say some publisher registered on my website and received script to place on the page with token. In addition publisher allows third-party javascript to run on his page, so the script do clickjacking attack for each second user who visit the page. How can I distinguish clickjacked user's requests from normal user's requests? |
