263 reputation
211
bio website google.com
location United Kingdom
age 32
visits member for 1 years, 9 months
seen Jul 29 '13 at 8:24

I just like to hack around with front end web technologies and am interested in infosec


Dec
11
awarded  Notable Question
Jul
28
asked Why is this response splitting attack not working?
Jul
9
awarded  Yearling
Dec
15
comment Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
Yeah, I checked with PTO and polynomial is right. They also say that they are working on a JSON feed which sounds good. I think I'll just submit to them.
Dec
14
awarded  Popular Question
Dec
14
awarded  Nice Question
Dec
14
asked Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
Dec
14
comment Why don't people hash and salt usernames before storing them
Perhaps by using a site wide salt (or pepper as I think that's known)
Dec
13
comment Is howsecureismypassword.net safe to use?
Just because it doesn't have your username doesn't mean it's "safe". It could be adding every password submitted to a dictionary that could be used for brute forcing at a later date. Once your password is in a dictionary it is much less secure. It is best not to ever reveal a password anywhere except to the service that requires it.
Dec
13
awarded  Critic
Dec
13
comment Why don't people hash and salt usernames before storing them
It would give a very small amount of extra protection, but admittedly not much. It could give the benefit though that it obscures users usernames, which are likely to be email addresses which could be used for targeted phishing attacks.
Dec
13
comment Why don't people hash and salt usernames before storing them
That's a fair point I suppose. I doubt my email address is in any rainbow tables as it's quite a number of characters. I guess that's probably true of most peoples including yours. Having said that, there must be tons of email addresses that are [a-zA-z0-9]{8}@hotmail.com. That wouldn't require a huge rainbow table, though I have no idea (and doubt) if anyone has ever made one like that
Dec
13
awarded  Scholar
Dec
13
comment Why don't people hash and salt usernames before storing them
I think this answer and it's comments are the best for me. Thanks.
Dec
13
accepted Why don't people hash and salt usernames before storing them
Dec
13
comment Why don't people hash and salt usernames before storing them
@LucasKauffman I guess that's a good point, it helps to be able to email your users. That certainly would certainly mean hashing it before storing could not be done!
Dec
13
comment Why don't people hash and salt usernames before storing them
@Ramhound I'm sure you are right that there's a reason that this isn't done. I just want to know why. If we used a site wide salt for the usernames (I know this would mean it would be possible to attack all hashes in one sweep using brute force) then you could still lookup the username by hashing it before performing the query
Dec
13
awarded  Commentator
Dec
13
comment Why don't people hash and salt usernames before storing them
@lynks but wouldn't it be nice if when a database was compromised, they didn't get all the email addresses of the users. Not only can they SPAM these addresses, they can also target them with site specific phishing attacks
Dec
13
comment Why don't people hash and salt usernames before storing them
@Thomas good one!