Viewing profile — davekt

https://typing.io/lessons let you type through code, which exercises the right pinky more than prose. The site also requires backspacing to correct typos. This adds realistic overh…

Some amex cards have a 3 digit cvv [1]. [1] http://ecommerce.shopify.com/c/shopify-discussion/t/heads-up...

The home page of this article has a section comparing text inputs vs drop downs [1]. [1] http://creditcardjs.com/#drop-down-for-expiration

One scenario where immediate detection is helpful is for unsupported card types. The server detection would require users first fill all their card data only to discover they need …

For a production ready alternative, take a look at http://creditcardjs.com , which was posted on HN a while back. The web site points out common mistakes when implementing credit c…

Thanks for responding. I would argue the opposite, that the browser is the safest place to sanitize because it better understands the context where user generated strings will be i…

Correct. If the 3rd party js properly sanitizes user input, this xss attack is moot. However, browsers love to eval stuff ( http://html5sec.org/ ), and sandbox iframes provide good…

An example attack iframes would make more difficult is XSS in the comment fields, e.g. an attacker bypasses sanitization and injects js into a page. With a sandbox iframe, the comm…

For 3rd party widgets, I actually prefer iframe for security. The same domain policy makes it more difficult for xss in the iframe to compromise the parent page. For HTML5 sandbox …