Hogan

New York, NY

Age: 48

25+ years...
ASM, C, C++, C#, VB, ASP.NET, TSQL +many more


The postings on this site are my own and don't necessarily represent IBM's positions, strategies or opinions.


Programmer, Architect, Team Lead, Director, CTO
MS Comp. Sci @ NYU '95
hoganlong at us.ibm.com // hoganlong at gmail.com

1d
comment How to get particular value from SqlCommand
at the very least do the following to protect from injection attacks: ((int)Session["RgId"]).ToString()
1d
comment Can not figure out why my Select Dropdown only updates once
jsfiddle.net/k2heLcw3
1d
comment Can not figure out why my Select Dropdown only updates once
why use the name attribute at all?
1d
comment DateAdd Unrecognized Identifier
Try just "Day" this is SQL not C# msdn.microsoft.com/en-us/library/ms186819.aspx
1d
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
Not sure I agree with that. I think SQRL is about improving (but not perfecting) the authentication "problem". Part of that involves security and part of that involves removing barriers and increasing convenience without sacrificing security. The phishing problem exists with the current model and exists with the SQRL model. Some things are better with the SQRL model.
1d
comment Table-Valued Function in Oracle
I think Art has no idea what he is saying.
1d
comment Combine the Data of two SQL databases to one
ok, what do you want to do if you don't want to merge... you want to assign new keys to the new records?
1d
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
But this can easily be avoided by the client. Saying this is a fault of the protocol is the same as saying HTML protocol is bad because fishing attacks can exist on them too.
1d
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
No it really does not work. Part of the protocol uses the presenting site: "The smartphone's SQRL authentication app cryptographically hashes the domain name of the site keyed by the user's master key to produce a site-specific public key pair."
2d
comment Prevent location being exposed through VPN
I expect it is the browser and not the VPN. Try using fiddler to view all traffic between google and the browser -- my suss out the truth there.
Feb
25
comment How to perform safe authentication via HTTP?
Deeply flawed is a bit strong -- on your link no one made claims about it being flawed, they were mostly questioning how it would be used and if the client would work as expected. In fact, it would solve the "problem" of this question. But I still think the best answer for the asker is to just use TLS which is not hard. But saying "don't do it that way" is generally frowned on on stackexchange sites.
Feb
25
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
This won't work. The domain name of the page being visited is different than the site you are getting the code from the client and user can verify this.
Feb
24
comment Replace even/odd occurrences of string in SQL SELECT Query
@Gonzalo - MWillemse wrote this, please thank him. To use on multiple columns you should make a function and then call it. Maybe MWillemse will revise the answer to include that?
Feb
24
comment Replace even/odd occurrences of string in SQL SELECT Query
Yeah, if you need to do some funky string work you really want a CLR
Feb
24
comment Replace even/odd occurrences of string in SQL SELECT Query
Now you know - sqlperformance.com/2012/07/t-sql-queries/split-strings
Feb
24
comment Replace even/odd occurrences of string in SQL SELECT Query
Is this really fast?
Feb
24
comment Replace even/odd occurrences of string in SQL SELECT Query
Is there a reason you have to do this on the SQL side. This kind of task is much easier using C# or another client side programming language.
Feb
24
comment Replace even/odd occurrences of string in SQL SELECT Query
The question is not rows of data but a single field with ,s in it that he wants to replace every 2nd one.
Feb
24
comment How does the MITM (Man in the middle) attack happen with respect to SQRL
@tylerl - the QR is the same as "form url" it is just text encoded as an image. Thus being an image can't make the process any less secure. as gewenfawr says a website can't use there URL to get access so there is no MITM possible. So you have authenticated to paypal.evil. Since you don't have a password with SQRL there no information paypal.evil could extract that would help a man in the middle to paypal.com. They might be able to fool you into putting in other personal information -- but that is not MITM.
Feb
24
comment How to perform safe authentication via HTTP?
@S.L.Barth - Also some non-criticism of SQRL too. :)
1 2 3 4 5