Hot answers tagged

5

There's a big gap between "does not require" and "implemented by the lowest bidder". why do we even use full-power database software and SQL queries Because if you're already running a SQL database for your transactional data, implementing a second technology stack with appropriately trained development and support staff for a very specific function is ...


1

Trusted party is exactly that. Someone who is trusted when he identifies you. The most basic vouching happens when you go in front of the HelpDesk and tell them that you forgot your password and are now locked out of your account. Then the IT staff vouches that it's you and resets your password. Now suppose that no domain admin was available when you went ...


1

People who say that are confused. You need to not blindly trust data stored in cookies for important operations, but storing non-confidential (and the username is not confidential) information in a cookie for convenience is fine. Just don't use it for security decisions without validating it first. So, storing the username in a cookie to say "Welcome ...


1

In its plain form, CBC-MAC is vulnerable to "length extension attack", where you just add some blocks at the end. So in order to stop people from doing that, you need to somehow mark the final block as indeed the final block. And not treat it like any other block. Wikipedia lists two ways: either prefix with block count, or encrypt final block with ...


1

It is a bad idea to generate the key for asymmetric cryptography totally on predictable data (i.e. user chosen password) instead of secure random data. By basing the key completely on predictable data the key gets the same predictability as the password used as input. Still, asymmetric cryptography can be used for authentication/login but not in the way you ...


1

usually a user table provides the relational association to content in the actual database. eg user:jon_smith posted this blog post The user table is also the logical place to store login credentials. The problem/question is not 'why is a database storing login credentials', but rather 'why arent people storing hashed values of passwords and comparing the ...


1

Another angle to symcbean's answer. The whole situation seems rather simplified. Who should take care of what can be queried and what can't? The underliyng DB (using special tables for user storage), the backend of the web application server or even a WAF? What about queries including LIKE statements (i.e. PasswordHash like 'a%', you can see where this is ...



Only top voted, non community-wiki answers of a minimum length are eligible