« first day (966 days earlier)      last day (3996 days later) » 

8:00 PM
HA! They never changed the password to the test Twitter account I made at my old job.
This could be fun.
 
why is a rat running all over my bed?
 
(be back in ~1 hour)
 
@m59

window.onload ->
  $.ajax
    type: 'GET'
    url: 'page.php?=gencsrftoken'
    success: (data) ->
      document.getElementById('csrf_token').value = data.newToken
 
why is bee running all over my bed :P just kidding
 
@web2students.com it's hard to take you seriously with this username. Just sayin'
 
8:09 PM
is there anything that can be improved in my answer here? stackoverflow.com/questions/17001961/…
 
@m59 should be okay
!!go back to sleep or get up and start working?
 
!!/choose minecraft c blog read "troll former employer"
 
Read former minecraft
 
how do i find out the length of this? {id: 'Select1', name: 'drop1'}
 
m59
@Gacnt I'm feeling like your idea is still vulnerable
 
8:18 PM
dunno, ask @phenomnomnominal
 
@Connor you mean, Object.keys(x).length?
 
user1596138
@Gacnt This doesn't look like a good idea...
 
m59
@Gacnt like...say I'm the attacking site and I cause you to request that token generating file. Then I could get the token and use it
 
user1596138
@Connor What is it?
 
m59
err, cause you to use it
@Gacnt it would be like csrf to get the token to avoid csrf lol
 
8:19 PM
@JanDvorak Thanks :)
 
user1596138
@m59 This is what I thought... Although it would be harder still. It still isn't very safe.
 
lol, i never said it was a good idea, the logic is there in my mind, Node auto-handles CSRF for me, so I'm not sure
 
m59
yeah, it's cool. I feel good about my idea. If someone steals a cookie to get the token, makes the attacking site use that token, my user visits that site, and a malicious attack goes through all before my user has closed my page or logged out
then my goodness.
grats to that hacker
 
user1596138
@m59 That's a terrible way to look at it... Considering this is a public message board and now I have all the info I need to do it.
 
@m59, oh no @Gacnts idea is awful
I thought you meant what we were first talking about
 
8:23 PM
@m59 if cookies are stolen i don't think there is any way to protect site . do any1 has idea?
 
you need a per session cookie that is inserted with ever request sent from your page (if you have jquery use ajaxStart)
 
@CapricaSix what's up?
 
@m59 I closed up the same thing on our site about 2 months ago
 
No responses yet eh?
 
@phenomnomnominal if 1st cookie is stolen hacker can generate ajaxstart cookie also
 
8:26 PM
No, because the cookie is only valid for that one session
 
Anyone able to help with Binary Search Tree recursion question?
 
The amount of security nonsense is too damn high
@m59 there is a fundamental flaw with your idea
 
user1596138
@rlemon I believe she is offline...
 
Others, you can't just steal a cookie
 
8:30 PM
^ this
 
You don't have any way to access them with code if they're HttpOnly
 
user1596138
@BenjaminGruenbaum I think they mean falsely generating a cookie rather than "stealing" it.
 
@user1613928 java go home
 
Don't roll your own crypto
 
@BenjaminGruenbaum i can if u allow me xss attack at your site :P
 
user1596138
8:31 PM
@web2students.com What?
 
@web2students.com Hi okok
 
@JanDvorak sigh
 
@web2.. No, you still can't
 
@Jhawinsss no, because correct CSRF protection will know if you falsely generate a cookie, because there will be a mismatch on the request
 
user1596138
@copy How could he have changed his name again so quickly...
 
8:32 PM
He didn't
 
@BenjaminGruenbaum i have done it successfully 1-2 times
 
@Jhawinsss Just kiddin'
 
Damn I hate mobile
 
user1596138
@phenomnomnominal This is in reply to what?
 
> I think they mean falsely generating a cookie rather than "stealing" it.
 
user1596138
8:32 PM
@web2students.com You have done it 1 to 2 times? Lmao
 
the concept of stealing a cookie is just wrong
 
something like this <img src="mydomain/page.php?id=<script>document.cookie</script>">
 
user1596138
@phenomnomnominal Ah. I haven't been watching this since the beginning so I'm not sure what we're talking about.
 
@web2 in order for you to steal a session cookie with XSS someone has to be a retard, not that it matters. If someone was dumb enough to have an XSS problem...
 
@Jhawinsss, all good. just about CSRF
 
user1596138
8:34 PM
@web2students.com You are stupid.
 
@web2students.com just, fuck.
 
Be polite!
 
I'm afraid I can't do that, Ben.
 
@phenomnomnominal By the way, addendum to what I said yesterday about imageData. It's the same speed, but only at first. After a bunch of redraws, 300ms-GC-lags start appearing
 
No reason to be rude. Web2whatever, read on what an HttpOnly cookie is
 
user1596138
8:36 PM
Well, he has no idea what he's talking about. Also he doesn't even know how many times he has supposedly done this before. "1-2 times"
 
@copy, so what, the imageData lags behind the actual canvas? Hence the all black data?
 
No, the process goes in 100% cpu mode for 300ms
 
lol what it's called, if it's not stealing?i don't know word but i have login using curl and xss attack at other site . and it was not httponly
 
@copy, ah
 
@web2students.com so you're telling us that some site was poorly secured on the Internet? No way!
 
8:38 PM
my work from the last 2 weeks is done
 
@Florian Nice!
 
I should add some more information on what it does
 
Minifies CSS?
 
@BenjaminGruenbaum yes, there are still many sites that are poorly secure, even i can do such stuffs
 
8:41 PM
Your site is not secure either :)
 
@BenjaminGruenbaum yeah... but it also inlines images with their base64 counterpart
 
Can you spot the problem?
 
and does some "clever" space optimization
 
Inlining images makes parallel downloading of resources sad :(
 
@BenjaminGruenbaum i am using wordpress, so i don't know..i feel php as home ground
 
user1596138
8:42 PM
@web2students.com Got your own site? I'd love to see it right now.
 
user1596138
Found it.
 
@web2students find it :)
 
my site is hacked it was in wordpress
 
@BenjaminGruenbaum less http requests = better. Plus, the css file is only downloaded once
 
Joshiah, how were you able to find his site?
 
8:43 PM
and honestly, it's the most convenient optimization
css sprites are a pita..
 
user1596138
@BenjaminGruenbaum It's in his SO profile... Haha
 
@Florian, it has pros and cons :)
 
user1596138
 
@Jhawinsss you're kidding right?
 
user1596138
I don't think there's anything wrong with posting this link because it's in his SO profile already. I don't want to repeat the other day.
 
8:44 PM
the biggest pro of base64 images is the convenience :P
 
@Chris , I don't think so :p
 
@Jhawinsss, No I just mean why did you not just try his username?
 
@Josh . It's his user name
I hate mobile :/
 
user1596138
@phenomnomnominal I don't know?
 
that's my blog also
 
8:46 PM
It's too early in the morning for this kind of stupid.
 
there's another optimization I could add...
hm, no.
 
@phenomnomnominal come back, we will continue stupidity afternoon :P
 
user1596138
@phenomnomnominal What did I do?? Haha
 
@Jhawinsss not you
Well, a little bit.
 
8:47 PM
it'd change functionality of the css (I was thinking about merging the prop/values of the same selectors
 
user1596138
Eh.
 
user1596138
Doesn't bother me.
 
I might go for a swim.
On second thoughts, nope
 
user1596138
Anyway I found 2 forms so far without csrf protection @web2students.com
 
@Florian , now write a LESS compiler :)
 
8:48 PM
@BenjaminGruenbaum could be done
but I was thinking about staying "standard compliant"
 
user1596138
Kind of funny how it's exactly what you've been going on about.
 
and just implement css variables
 
Not everything needs csrf protection
 
@Jhawinsss csrf for anonymous users is useless, you know?
 
user1596138
@FlorianMargaine I know. It's just that he's going on about it.
 
8:51 PM
@Jhawinsss i just added image capache below comment, nothing else, Subscription form is without protection
 
user1596138
@web2students.com Shall we go ahead and pentest your site? I'm pretty bored.
 
user1596138
Although there's not really anything to it. Nothing actually written by you that I can find. Just a WP template.
 
@Jhawinsss sure only if you tell me how to make it more secure later
 
user1596138
@web2students.com I was being sarcastic. There's nothing written by you there unless you maybe tweaked some CSS. Why would I have any interest in hacking another generic WP blog.
 
@Jhawinsss i am stupid, don't understood ur sarcasticm
@Jhawinsss i am bad in design and i am not full serious at this time so i am not improving
 
user1596138
8:55 PM
I'm going to find something more productive to do.
 
user1596138
But first you should look at this link. web2students.com/web2blog/comments/feed
 
user1596138
I'd fix it since it's on the front page. Unless you really just don't care.
 
reddit.com/r/DotA2/comments/1fxhso/… push me over 100 upvotes pl0x
 
user1596138
@Gacnt Spelling/grammar.
 
user1596138
That's all I have to say.
 
8:59 PM
ok, i will fix it, i will make google ads smaller and improve form design ( i did these two things only except posting pages/posts at my site, both are horrible!! )
 
m59
@BenjaminGruenbaum sorry, I was afk. What was the problem?
 
user1596138
 

« first day (966 days earlier)      last day (3996 days later) »