743 reputation
522
bio website johngraybosch.com
location
age
visits member for 2 years, 6 months
seen yesterday

I'm an Application Developer in Long Island, NY.


Jun
6
asked RSA vs PBKDF2 for password storage (theoretical)
May
17
comment Protecting Password Hashes with Store Procedures?
That's what I thought you meant. Any examples / products that do this?
May
17
comment Password Verification Server
@tylerl Do companies ever implement a separate password validation server on a general purpose computer? I'm curious if this approach is used at all since it does seem to add a nice layer of protection.
May
15
accepted Password Verification Server
May
15
comment Protecting Password Hashes with Store Procedures?
what do you mean by "dedicated password verification server"?
May
15
comment Password Verification Server
Ok, is there anything similar to this that's software-based?
May
15
asked Password Verification Server
May
10
accepted Protecting Password Hashes with Store Procedures?
May
10
comment Protecting Password Hashes with Store Procedures?
Can you point out any tutorials for setting up a dedicated password server for asp.net?
May
10
comment Protecting Password Hashes with Store Procedures?
@SébastienRenauld it would seem that this answer security.stackexchange.com/a/6065/25821 describes exactly the scenario I mentioned...
May
10
comment Protecting Password Hashes with Store Procedures?
@SébastienRenauld really? Cause that would kind of blow my idea out of the water... There's gotta be another way to lock it down, no?
May
10
asked Protecting Password Hashes with Store Procedures?
May
10
comment Does escaping quotes protect me from SQL injection?
You definitely want to parametrize all of your SQL. If you can do this in all of your SQL by default in your data access layer code (i.e. in a framework) that's the best. There's no reason, ever, not to write parametrized queries.
May
8
comment Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?
The web browser you're logging into your bank account with does not have access to most of stats you mentioned, especially your MAC address. That being said, they can log quite a bit including the browser, OS, and IP address you're coming from. More than likely they use cookies in addition to these, though.
May
8
accepted Does prompting for security questions on new computers add any security on banking websites?
May
6
revised Does prompting for security questions on new computers add any security on banking websites?
added 513 characters in body
May
6
comment Does prompting for security questions on new computers add any security on banking websites?
Would a PIN that you enter with the mouse via an onscreen keypad be a better solution?
May
6
comment Does prompting for security questions on new computers add any security on banking websites?
Actually after having thought about it, if the hacker has physical access to the computer you're logging in from, it's all over. He could key log the security questions. Or, he could grab the cookie that's used to mark the computer as "trusted." Are there any measures you could take that would help the user at all really, in this scenario? It doesn't look good...
May
6
comment Does prompting for security questions on new computers add any security on banking websites?
Seems like a diluted version of two factor authentication...
May
6
asked Does prompting for security questions on new computers add any security on banking websites?