HNHacker News
TopNewBestAskShowJobs

hayroob

49 karma · joined July 12, 2009

submissionscomments
hayroob··on Don't Be Ugly By Accident
Higher birth rates doesn't imply more sex, it implies poor use of contraceptives, which you basically stated.
hayroob··on Don't Be Ugly By Accident
Women like unavailable men, so the iphone is where it's at.
hayroob··on Xcode 4 public preview - Single window, LLVM 2.0, streamlined editing
git and as petty as it is, not having to type @synthesize.
hayroob··on Ask HN: What DVR do you use?
You could try out boxee and an eyeTV on a mini or shuttle pc, it's pretty easy to set up.
hayroob··on Ask HN: Whats missing from podcasting? Why hasn't the market grown larger?
Podcasting for most is an analog for radio and until podcasts are as at hand as radio is, it's market share will be capped. Most people want to be able to press a button their dashboard and here a show, not go search it out, put it on their iPod and then hook that up to their car.
hayroob··on How Do IPhone Users Find New Apps?
If you're looking for a specific kind of app I use yappler.com, lot easier than iTunes
hayroob··on Managing Your Digital Comics Colllection
Cool open source software to manage your digital comics and a basic summary of the state of digital comics.
hayroob··on Secure Persistent Login With Very Little SSL
Is there a reference implementation that you like and that is well documented.
hayroob··on Secure Persistent Login With Very Little SSL
That seems like viable thought. I will watch the presentation when I get a chance, but for now I will modify the article to consider this scenario and my code already forces SSL on the login page and the authentication script.
hayroob··on Secure Persistent Login With Very Little SSL
ya I should probably being using HMAC
hayroob··on Secure Persistent Login With Very Little SSL
SSL is relevant and in my actual implementation, which I am prepping now, I do use SSL on the login form, but technically, the form it is submitting to needs to be SSL, but the form itself does not.

Since I wrote the article I have made some small adjustments to the AES key dialogue, they key is generated at the login form using javascript then sent as an ssl cookie to the authentication form and also stored into a local persistent storage, which is not accessible (barring an exploit.) Once the auth page is reached the aes and guid cookies are cleared. I suppose that a script could be crafted to cause the user to reveal the key and guid stored in persistent storage, this is something I am still working on securing against.

I will consider your suggestions carefully and attempt to integrate them as I work to code this out.

I have posted this discussion into the comments in the article and will be updating it tonight to reflect this conversation. Thank You.