User talk:Blaufish
Talk!
HTTP cookie
Hi. I have seen you have added an interesting section to that article. There is however a point you may clarify: I understand that the difference between cookie theft and cross site cooking is that the first works by making the browser execute a script, while the second exploit a browser bug. Is this correct? Or is the difference not this one? - Liberatore(T) 00:36, 11 February 2006 (UTC)
Blaufish (Longer reply T): Cookie theft is many different things exploits. The purpose of cookie theft is for someone to steal cookies from client / server communication. Yes, cookie theft through cross site scripting does involve executing scripts.
Cross Site Cooking is however that another malicious site is confusing a browser, and setting the cookie. http://evil-guy/ setting cookies for http://your-bank/ and such.
- Thank you, now it's perfectly clear to me. I have added three images in HTTP cookie to clarify the difference. If you think they are incorrect in some way, let me know so that I can modify them.
- As for the talk pages, most people just do what you did (write in the talk page of the person they want to tell something to). BTW, to sign your post, add four tildes, like: ~~~~. This automatically adds your name and the date of the post. - Liberatore(T) 13:53, 15 February 2006 (UTC)
Welcome
And, since you haven't received a welcome message so far:
Welcome!
Hello, Blaufish, and
- The five pillars of Wikipedia
- How to edit a page
- Help pages
- Tutorial
- How to write a great article
- Manual of Style
I hope you enjoy editing here and being a
{{helpme}} on your talk page and someone will show up shortly to answer your questions. Again, welcome! - Liberatore(T) 00:36, 11 February 2006 (UTC)
It is a good idea to create this article :) However, I think that the first example, "Trivial attack scenario", is over-simplified and could lead the reader to think it is just about injecting HTTP variables as script global variables. The third example is misleading too, in my opinion. I suggest removing them or making them clearer. Cheers !
What is '%c0%9v'?
URL encoding don't include 'v'. Please reedit
Reply: I have clarified and added references. UTF-8 attacks also did include invalid percent encodings, so there were actually two encoding problems exploited in the same attacks. IIRC, it was highly dependent on the particular
ArbCom elections are now open!
Hi,
You appear to be eligible to vote in the current
October 2020
Your edit to Block cipher mode of operation has been removed in whole or in part, as it appears to have added copyrighted material to Wikipedia without evidence of permission from the copyright holder. If you are the copyright holder, please read Wikipedia:Donating copyrighted materials for more information on uploading your material to Wikipedia. For legal reasons, Wikipedia cannot accept copyrighted material, including text or images from print publications or from other websites, without an appropriate and verifiable license. All such contributions will be deleted. You may use external websites or publications as a source of information, but not as a source of content, such as sentences or images—you must write using your own words. Wikipedia takes copyright very seriously, and persistent violators of our copyright policy will be blocked from editing. See Wikipedia:Copying text from other sources for more information. — Diannaa (talk) 21:27, 20 October 2020 (UTC)
Sorry. I thought the IETF RFC description and the research article it is based on was in the public domain and loosely reworded. I'll rewrite in my own words :)
Blaufish (talk) 18:07, 21 October 2020 (UTC)