John

492 reputation

bio	website	johngraybosch.com
	location
	age
visits	member for	11 months
	seen	2 days ago
stats	profile views	18

I'm an Application Developer in Long Island, NY.

	492 reputation	bio	website	johngraybosch.com	visits	member for	11 months
18 badges		location			seen	2 days ago

summary answers questions tags badges favorites bounties reputation activity

125 Actions

suggestions reviews revisions comments badges posts accepts all

2d	comment	Protecting Password Hashes with Store Procedures? That's what I thought you meant. Any examples / products that do this?
2d	comment	Password Verification Server @tylerl Do companies ever implement a separate password validation server on a general purpose computer? I'm curious if this approach is used at all since it does seem to add a nice layer of protection.
May 15	accepted	Password Verification Server
May 15	comment	Protecting Password Hashes with Store Procedures? what do you mean by "dedicated password verification server"?
May 15	comment	Password Verification Server Ok, is there anything similar to this that's software-based?
May 15	asked	Password Verification Server
May 10	accepted	Protecting Password Hashes with Store Procedures?
May 10	comment	Protecting Password Hashes with Store Procedures? Can you point out any tutorials for setting up a dedicated password server for asp.net?
May 10	comment	Protecting Password Hashes with Store Procedures? @SébastienRenauld it would seem that this answer security.stackexchange.com/a/6065/25821 describes exactly the scenario I mentioned...
May 10	comment	Protecting Password Hashes with Store Procedures? @SébastienRenauld really? Cause that would kind of blow my idea out of the water... There's gotta be another way to lock it down, no?
May 10	asked	Protecting Password Hashes with Store Procedures?
May 10	comment	Does escaping quotes protect me from SQL injection? You definitely want to parametrize all of your SQL. If you can do this in all of your SQL by default in your data access layer code (i.e. in a framework) that's the best. There's no reason, ever, not to write parametrized queries.
May 8	comment	Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”? The web browser you're logging into your bank account with does not have access to most of stats you mentioned, especially your MAC address. That being said, they can log quite a bit including the browser, OS, and IP address you're coming from. More than likely they use cookies in addition to these, though.
May 8	accepted	Does prompting for security questions on new computers add any security on banking websites?
May 6	revised	Does prompting for security questions on new computers add any security on banking websites? added 513 characters in body
May 6	comment	Does prompting for security questions on new computers add any security on banking websites? Would a PIN that you enter with the mouse via an onscreen keypad be a better solution?
May 6	comment	Does prompting for security questions on new computers add any security on banking websites? Actually after having thought about it, if the hacker has physical access to the computer you're logging in from, it's all over. He could key log the security questions. Or, he could grab the cookie that's used to mark the computer as "trusted." Are there any measures you could take that would help the user at all really, in this scenario? It doesn't look good...
May 6	comment	Does prompting for security questions on new computers add any security on banking websites? Seems like a diluted version of two factor authentication...
May 6	asked	Does prompting for security questions on new computers add any security on banking websites?
May 6	comment	VCS to manipulate returned trees to prevent leaks? Ahh, I see you're asking a hypothetical question about what the big boys do. I agree with @Adnan about the NDA. Nobody wants to lose their house in a lawsuit ;)