153 reputation
6
bio website tclayson.com
location Cambridgeshire, United Kingdom
age 23
visits member for 2 years, 3 months
seen Jul 10 '13 at 12:43

I am a professional mobile and web developer.


Mar
24
comment How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
Thanks for this. Although we are aware of benefits of a time based system, our client has specifically asked for a hmac based system. I don't think we really want to be syncing over the connection either, as you say it makes it easier to attack if you can get the current counter value on request.
Mar
24
comment How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
Brilliant thank you! That's very well explained, and makes sense.
Mar
24
accepted How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
Mar
21
asked How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
Aug
20
awarded  Editor
Aug
20
comment Why do some large companies still store passwords in plain text/decrypt-able format?
@Polynomial I guess you've just answered my question then. :p I was hoping/suspecting that someone would say "they know what they're doing... here's why its secure". But I guess the answer is "no-one knows but them why they do it like that". Thanks! :)
Aug
20
revised Why do some large companies still store passwords in plain text/decrypt-able format?
edited for clarity.
Aug
20
comment Why do some large companies still store passwords in plain text/decrypt-able format?
I disagree. I am looking for objective answers that help me to understand the situation. Am I wrong for thinking that large companies are doing it insecurely? A the end of the day Tesco and Plusnet are two huge companies who will have resource which far outweighs my knowledge of the systems and security in place. I'm looking for answers like "they'll probably use x,y,z so you are wrong in your assumption" or (as we have) "it is bad that they do this for a,b,c reasons".
Aug
20
awarded  Commentator
Aug
20
comment Why do some large companies still store passwords in plain text/decrypt-able format?
You say that password reset is "non-trivial" but I would have thought that companies like Tesco are large enough and have enough resource and money to implement something like that. That said there are also plenty of open source implementations of password reset forms, and its something that I use in my own applications frequently. If I can do it, and if the open source community can do it then Tescos and other similar companies can do it surely?
Aug
20
comment Why do some large companies still store passwords in plain text/decrypt-able format?
Good answer. I used salt+md5/sha as an example. I have heard that the latest versions of SHA512 are pretty secure, and although md5 has been cracked etc, its still a reasonable first step in my opinion. Your standard SQL-injection script kiddie isn't going to be able to crack it. I was implying that the first thing I do is to AT LEAST salt and one-way encrypt it, I would never think about storing it in plain text or a two way encryption (e.g. base64 style).
Aug
20
asked Why do some large companies still store passwords in plain text/decrypt-able format?
Jun
18
comment Could this login form be “hacked” to allow access?
This is a nightmare! haha
Jun
18
comment Could this login form be “hacked” to allow access?
Ah well spotted. :) This is circumvented in the actual code by a prior check for the email address in the table before getting to this point. However, that too can be circumvented by using the email address dontcare' OR 1=1 OR email='dontcare as it is just a simple mysql_num_rows($result) > 0 check.
Jun
18
comment Could this login form be “hacked” to allow access?
If I butcher the code up then yes, in practice (and based on the info I gave you in the question) your sql injection works. :) But by sheer fluke, it seems its more secure than I thought. :p haha
Jun
18
comment Could this login form be “hacked” to allow access?
Two things happen. Firstly the server has magic_quotes on. So it automatically escapes the instances of ' in the code. When I do stripslashes($email) another thing happens. Prior to the query in the question it first runs a query looking for records with the $email in it. E.g SELECT * FROM users WHERE email='$email' and then checks mysql_num_rows($result) to make sure that the email is actually in the database. When there's two queries this throws an error and the code never gets to the bit where the password is checked. Don't know if this is genius design or pure coincidence. :p
Jun
18
awarded  Scholar
Jun
18
comment Could this login form be “hacked” to allow access?
I dunno... it was an employee who left before I started. Thankfully there's not much else like this around. Nowadays I use Wordpress for CMS driven sites and Codeigniter+Ion Auth for more complex sites. Both of which have professionally written auth functionality and database classes which take care of most of the issues you're going to come across with injection and such. Still its nice to know why this is a security risk, and how it could affect other things I do. :) Thanks
Jun
18
accepted Could this login form be “hacked” to allow access?
Jun
18
comment Could this login form be “hacked” to allow access?
Ah very well answered. I couldn't work it out myself. I knew there must be a way. Time to get some mysql_real_escape_strings in there now. :) Thanks for the help.