yfeldblum

2,021 reputation

1012

bio	website
	location
	age
visits	member for	2 years, 5 months
	seen	May 9 at 20:52
stats	profile views	51

	2,021 reputation	bio	website		visits	member for	2 years, 5 months
1012 badges		location			seen	May 9 at 20:52

summary answers questions tags badges favorites bounties reputation activity

114 Actions

suggestions reviews revisions comments badges posts accepts all

May 8	awarded	Good Answer
Jan 18	awarded	Notable Question
Jan 13	answered	Bot detecting by considering request inter-arrival time
Jan 13	comment	How about preventing CSRF this way? Use signed session cookies, include the CSRF token in the signed session cookies, and problem solved?
Dec 22	awarded	Yearling
Aug 14	awarded	Caucus
Jul 13	comment	Good session practices Firstly, is the session-id generated by a cryptgraphically-strong PRNG, and suitably long as to be unguessable and unforgeable? Secondly, it is more important for those who session data in cookies.
May 21	comment	Could mint.com be more secure, and if so, how? Mint might be keeping the session cookie cached. Until the session expires, they won't be forced to log in because they're already in. When the session expires, they'll need to try to log in again, at which point it fails because the password you gave them is no longer valid.
May 10	comment	header injection + codeigniter None of your examples has got anything to do with protecting the server from malicious or otherwise unexpected data sent by the client (except perhaps cookie encryption, if that is indeed what you're doing).
Apr 12	revised	What are the most common password salting methods? added 67 characters in body
Feb 1	comment	How are open-sourced operating systems and software kept secure? Indeed they are. That's why they warn you that the software is not warranted at all or in any way, and that if you choose to use it you are explicitly agreeing to use it at your own risk only.
Jan 30	awarded	Necromancer
Jan 27	comment	Regulations that specify password length? I, being a regulatory body that I recognize, regulate that all passwords shall have at least one character.
Jan 24	awarded	Guru
Jan 22	answered	Zero padding in HMAC
Jan 12	comment	VM hypervisior that doesn't leak that it's a VM to the guest? What is the security reason?
Jan 2	awarded	Popular Question
Dec 27	revised	Explaining security vs. performace to a non-tech superior deleted 10 characters in body
Dec 25	answered	Explaining security vs. performace to a non-tech superior
Dec 25	comment	Explaining security vs. performace to a non-tech superior "Then explain that the faster one is perfectly secure." That's the catch, isn't it. It's not.