21–30 of 76 posts
A “young, cool-people’s” coffee shop on the first floor of an old office building in downtown Chicago. A place like this exists? All I can think of is Intelligensia.
Our office is in fact a few floors up from the Intelligentsia in the Monadnock building.
Just have a server side session store and all of this cookie encryption crap just vanishes. Of course that won't help you with session fixation etc, but the post doesn't address that stuff either. Do it over TLS and you're pretty safe though.
And let's not forget the author's suggestion to pad out the cookie with 1000 bytes to make it harder to falsify. That cookie gets send with every single request. 20 images on the page, you're sending 20KB of junk up just to load the page. On a connection with slow upstream, like say ADSL, you can easily add a second or two of request latency. You might not care but some people sure do.
And come on, I read until the very end expecting to hear what "processes or threads" have to do with security, so tell us already!
A “young, cool-people’s” coffee shop on the first floor of an old office building in downtown Chicago. A place like this exists? All I can think of is Intelligensia.
It's a Louis CK bit, and an inside joke because the bit does match up with Intelligentsia (there's actually one of those in LA, where LCK wrote the bit, so I've always wondered). Our office is in fact a few floors up from the Intelligentsia in the Monadnock building.
A “young, cool-people’s” coffee shop on the first floor of an old office building in downtown Chicago. A place like this exists? All I can think of is Intelligensia.
It's a Louis CK bit, and an inside joke because the bit does match up with Intelligentsia (there's actually one of those in LA, where LCK wrote the bit, so I've always wondered). Our office is in fact a few floors up from the Intelligentsia in the Monadnock building.
But it allows everyone to concentrate on how you're managing the secure context instead of what algorithm has been shown to cause cancer in rats.
Unfortunately, there's seems to be a huge gap between the average working programmer, who often has little idea how to do security, and the security guru's who are often barely intelligible to the rest of us. :-)
Sadly, the result of most programmer's poor understanding of security is even worse than the bad crypto implementation in the article. It's often something as basic as thinking it's O.K. to store user passwords un-hashed. (http://news.ycombinator.com/item?id=628680)
Related to this: http://www.codinghorror.com/blog/archives/001267.html I assume.
Is the "AES" line a tptacek catchphrase? Or is he quoting someone else?