1,908 reputation
522
bio website software-talk.org
location Germany
age 28
visits member for 3 years
seen 4 hours ago

-.-


5h
revised Password hashes history to prevent user to keep same passwords again and again
accidentaly deleted something on last edit
5h
comment Password hashes history to prevent user to keep same passwords again and again
@HassanSaqib You are right, that option does seem to exist. But it seems that you can also enter completely random data. I don't know what exactly is happening there, but if this still exists, it's quite worrying.
5h
comment Password hashes history to prevent user to keep same passwords again and again
@HassanSaqib I've never seen that option for Google (and I would be very surprised if it existed, as it seems like an extremely bad idea). I don't know about Facebook, but it sounds as if they have an option to "ban" passwords set by a possible attacker, which doesn't really hurt, but I don't see the advantage in it either.
5h
revised Password hashes history to prevent user to keep same passwords again and again
added 424 characters in body
5h
revised Password hashes history to prevent user to keep same passwords again and again
edited tags, removed content not relevant to question, gramar
5h
suggested approved edit on Password hashes history to prevent user to keep same passwords again and again
5h
revised Password hashes history to prevent user to keep same passwords again and again
added 320 characters in body
5h
answered Password hashes history to prevent user to keep same passwords again and again
6h
revised How to prevent Fingerprinting via Font Enumeration
clarified question and title
6h
comment How to prevent Fingerprinting via Font Enumeration
You might be interested in this question at superuser. This question might also be a duplicate of this question (the question is mainly about not exposing the content of fonts files, but some of it still applies).
6h
suggested approved edit on How to prevent Fingerprinting via Font Enumeration
1d
answered Classifying Reflected and DOM-based XSS
2d
answered Need some docs that say we shouldn't upper the string when saving it as a password
Mar
29
comment Is someone using my PHP script?
This doesn't seem to be a security related question. You might have better luck at stackoverflow, although you should show that you did some research (eg found some approach, but don't like it, or couldn't implement it completely). But basically, no, there isn't. You can of course count downloads of your script from wherever you host it, or you can include code in your script that reports to your server when it is installed, but both approaches are not 100% accurate).
Mar
29
awarded  Explainer
Mar
29
revised How to exploit Open Redirect Vulnerability?
better title
Mar
29
comment How to exploit Open Redirect Vulnerability?
@user2598085 Not really. You can highjack a session, or perform session fixation, and I guess theoretically this could enable an open redirect (eg if you change your example code to $redirectUrl = $_SESSION['url'];, and set $_SESSION['url'] in a different script) without the need to send the evil url, just the normal url, but this is a very contrived example, and if you can highjack/fixate a session, open redirect isn't the most interesting attack to perform.
Mar
29
suggested approved edit on How to exploit Open Redirect Vulnerability?
Mar
29
answered How to exploit Open Redirect Vulnerability?
Mar
28
answered How to fix open redirect vulnerability?