Iain

197 reputation

bio	website	iainbarnett.me.uk
	location	East Scotland
	age
visits	member for	1 year, 2 months
	seen	Feb 13 at 0:32
stats	profile views	7

	197 reputation	bio	website	iainbarnett.me.uk	visits	member for	1 year, 2 months
7 badges		location	East Scotland		seen	Feb 13 at 0:32

summary answers questions tags badges favorites bounties reputation activity

30 Actions

suggestions reviews revisions comments badges posts accepts all

Feb 6	comment	Picking an encryption algorithm for auth tokens passed via AJAX Having mulled it over I agree, there's no need to encrypt an identifier that is randomly generated and reasonably often regenerated. I suppose I'm just paranoid :)
Feb 6	accepted	Picking an encryption algorithm for auth tokens passed via AJAX
Feb 4	awarded	Custodian
Feb 4	reviewed	Needs Improvement Is it preferable to perform encryption using database functions or code?
Feb 4	reviewed	Needs Improvement How secure is Windows 8 email authentication?
Feb 4	comment	Picking an encryption algorithm for auth tokens passed via AJAX @ixe013 I don't wish to do any client side manipulation, but thanks for the link, very helpful. I've updated my question too to make it clearer.
Feb 4	comment	Picking an encryption algorithm for auth tokens passed via AJAX Thanks for the answer. I've updated the question with a few things that may or may not clarify things.
Feb 4	revised	Picking an encryption algorithm for auth tokens passed via AJAX Clarification due to the comments.
Feb 4	awarded	Commentator
Feb 4	comment	Picking an encryption algorithm for auth tokens passed via AJAX @Polynomial I don't know, which is why I asked the question :)
Feb 4	asked	Picking an encryption algorithm for auth tokens passed via AJAX
Nov 18	accepted	What's the best way to enumerate log/sign in attempts?
Nov 18	comment	What's the best way to enumerate log/sign in attempts? Thanks for a very helpful answer.
Nov 16	asked	What's the best way to enumerate log/sign in attempts?
Sep 26	comment	What is the purpose of using Youtube-style alphanumeric ids as URL slugs? @Polynomial no probs. Kevboh, all that it implies is that not every combination has been used. If there is a resource that is public if you have the random number/string then it's not secure unless it's a big number/string, or you squeeze the time the resource is available. For example, Heroku put database backups on AWS, publicly, with a long random string in the url. This works because the resource is only available for 10 minutes, so the chance of an attacker guessing the url in that time is very small. A short url will not be private for long.
Sep 26	comment	What is the purpose of using Youtube-style alphanumeric ids as URL slugs? @Polynomial I'd give you -1 if I could. Kevboh has made an assumption about security and is asking whether he's right, and why it would be used. If he's right, then someone should give an explanation behind the security. If not, they should help disavow him of the assumption. If you'd read the linked Stackoverflow question you'd see he'd asked how to implement this, which is exactly what that forum is for. This is about the security, hence it should be here.
Mar 25	awarded	Nice Question
Mar 23	comment	If I include a Forgot Password service, then what's the point of using a password? I've changed things so that on authentication via a reset link, the user is downgraded to a role of "password_reset", which only authorises them to change the password and do nothing else until that is done. That way only those using links will be downgraded and not those who've only requested resets (which isn't necessarily the user). I've also added the time of the last password update so the user's can see that info. Thanks for the advice.
Mar 23	comment	If I include a Forgot Password service, then what's the point of using a password? Ok, thanks for clarifying. So it authorises you enough to change the password but nothing else until the password is changed. That is very sensible, and a level above what I've done, thanks for pointing out this possible attack. +1
Mar 22	comment	If I include a Forgot Password service, then what's the point of using a password? When you write "These password reset forms should only allow you to change the password", what are the other options are you saying they can't/shouldn't have access to?