meta user
network profile
| bio | website | martinstoeckli.ch |
|---|---|---|
| location | Switzerland | |
| age | 40 | |
| visits | member for | 1 year, 2 months |
| seen | 3 hours ago | |
| stats | profile views | 119 |
I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working more and more with CSharp and use PHP for my spare time project, an internet lost-and-found office.
|
Jul 12 |
answered | Is this password hashing method secure? |
|
Jul 4 |
comment |
Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password? And the point of the story is, that you should prefer a slow hash algorithm to store passwords (bcrypt or scrypt), because fast hashes can be brute forced too easily (e.g. with a GPU). |
|
Jul 1 |
comment |
Do most browsers handle mixed encrypted and unencrypted content correctly? @curiousguy - To be honest, i don't grasp what you want to tell me. When the browser allows to prevent loading mixed content, this will prevent sending the cookie plaintext to HTTP requests, and that's good. When the user opens a page from example.com, there is no way for randomsite.com to redirect a HTTP request to example.com, because randomsite.com is simply never called. A site can prevent the session cookie to be sent to HTTP requests, but the developer has to do it explicitely (that's what i meant with default). |
|
Jul 1 |
comment |
Do most browsers handle mixed encrypted and unencrypted content correctly? @curiousguy - If the user opens a page from example.com, how could randomsite.com be involved? If you think of Cross-Site-Scripting here, this is quite another story, and needs other countermeasures. Also a redirect will result in two entirely different requests. The browser will first connect to randomsite.com (without sending the cookie), then because of the redirect to example.com (sending the cookie), so randomsite.com will never get the cookie. |
|
Jul 1 |
comment |
Do most browsers handle mixed encrypted and unencrypted content correctly? @curiousguy - Cookies are sent only to the domain, they originate from. A session cookie from the domain example.com would not be sent to randomsite.com. |
|
Jul 1 |
comment |
Do most browsers handle mixed encrypted and unencrypted content correctly? @curiousguy - 1) The user logs in with HTTPS. 2) The attacker makes a man in the middle attack. 3) The user loads a page with mixed content. 4) The attacker can read the session-id from the HTTP request. 5) The attacker can use this session-id to impersonate the user, even with HTTPS requests. |
|
Jul 1 |
answered | Do most browsers handle mixed encrypted and unencrypted content correctly? |
|
Jun 27 |
comment |
Security Review - password_hash implementation for PHP Yes i know it did, i have published example code myself, to explain the problem and to show that there is no reason against using it. But there was still the problem, that a developer had to make an effort to do it right. |
|
Jun 27 |
comment |
Security Review - password_hash implementation for PHP Your work is very much appreciated! If PHP has built-in support for bcrypt, the discussions about "how much security is necessary for storing passwords" will hopefully come to an end. |
|
Jun 11 |
comment |
Why would salt not have prevented LinkedIn passwords from getting cracked? Ahh, with this statement, Ptacek's answer makes a bit more sense. Remembers me that one should always get the whole picture before judging. |
|
Jun 10 |
comment |
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password? Interesting question! |
|
Jun 10 |
comment |
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password? As i understand it, the question was about already hashed values. If you hashed a password with a cost factor of 7, can you add some iterations to get a factor of 8? |
|
May 17 |
answered | Clicked on fake “Download Now!” ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take? |
|
May 15 |
awarded | Commentator |
|
May 15 |
comment |
PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities? Thanks for the illustrative example, just tried it out. |
|
May 8 |
comment |
Session fixation attack Do you have reason to ask for session fixation in particular, or do want to know if the scenario is safe (what it is not)? |
|
Apr 27 |
comment |
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login? @shadesco - Yes, the problem is, that you have to send the session id for every following request, so the server can recognize the user. When you send the id with HTTP, it can be eavesdropped and the attacker can use this id for his own requests. The server would recognize the attacker as the logged in user and would grant him the same priviledges. |
|
Apr 27 |
comment |
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login? So when somebody can prove that it fails, then shadesco would know that he should use another method, and that was his question, wasn't it? But you are right that it is probably not possible to prove the opposite. |
|
Apr 27 |
revised |
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login? added 48 characters in body |
|
Apr 27 |
answered | Can a session be hijacked if the user is redirected from HTTPS to HTTP after login? |
