Grezzo

243 reputation

bio	website	google.com
	location	United Kingdom
	age	31
visits	member for	10 months
	seen	Jan 31 at 9:05
stats	profile views	8

I just like to hack around with front end web technologies and am interested in infosec

	243 reputation	bio	website	google.com	visits	member for	10 months
11 badges		location	United Kingdom		seen	Jan 31 at 9:05

summary answers questions tags badges favorites bounties reputation activity

34 Actions

suggestions reviews revisions comments badges posts accepts all

Dec 15	comment	Is there a site like plaintextoffenders.com that shames companies that force insecure passwords? Yeah, I checked with PTO and polynomial is right. They also say that they are working on a JSON feed which sounds good. I think I'll just submit to them.
Dec 14	awarded	Popular Question
Dec 14	awarded	Nice Question
Dec 14	asked	Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
Dec 14	comment	Why don't people hash and salt usernames before storing them Perhaps by using a site wide salt (or pepper as I think that's known)
Dec 13	comment	Is howsecureismypassword.net safe to use? Just because it doesn't have your username doesn't mean it's "safe". It could be adding every password submitted to a dictionary that could be used for brute forcing at a later date. Once your password is in a dictionary it is much less secure. It is best not to ever reveal a password anywhere except to the service that requires it.
Dec 13	awarded	Critic
Dec 13	comment	Why don't people hash and salt usernames before storing them It would give a very small amount of extra protection, but admittedly not much. It could give the benefit though that it obscures users usernames, which are likely to be email addresses which could be used for targeted phishing attacks.
Dec 13	comment	Why don't people hash and salt usernames before storing them That's a fair point I suppose. I doubt my email address is in any rainbow tables as it's quite a number of characters. I guess that's probably true of most peoples including yours. Having said that, there must be tons of email addresses that are [a-zA-z0-9]{8}@hotmail.com. That wouldn't require a huge rainbow table, though I have no idea (and doubt) if anyone has ever made one like that
Dec 13	awarded	Scholar
Dec 13	comment	Why don't people hash and salt usernames before storing them I think this answer and it's comments are the best for me. Thanks.
Dec 13	accepted	Why don't people hash and salt usernames before storing them
Dec 13	comment	Why don't people hash and salt usernames before storing them @LucasKauffman I guess that's a good point, it helps to be able to email your users. That certainly would certainly mean hashing it before storing could not be done!
Dec 13	comment	Why don't people hash and salt usernames before storing them @Ramhound I'm sure you are right that there's a reason that this isn't done. I just want to know why. If we used a site wide salt for the usernames (I know this would mean it would be possible to attack all hashes in one sweep using brute force) then you could still lookup the username by hashing it before performing the query
Dec 13	awarded	Commentator
Dec 13	comment	Why don't people hash and salt usernames before storing them @lynks but wouldn't it be nice if when a database was compromised, they didn't get all the email addresses of the users. Not only can they SPAM these addresses, they can also target them with site specific phishing attacks
Dec 13	comment	Why don't people hash and salt usernames before storing them @Thomas good one!
Dec 13	comment	Why don't people hash and salt usernames before storing them That's not true. It is true that with a site specific salt they could attack all hashes at the same time using brute force, but without a salt attackers could use an unsalted rainbow table which would be much less effort. And after all, isn't security about making it too much effort to attack, not really about making it impossible?
Dec 13	comment	Why don't people hash and salt usernames before storing them @Polynomial It may not be necessarry, but if login names were something like email addresses, it could be a good way of trying to hide a users email address if the database were to get dumped, no?
Dec 13	comment	Why don't people hash and salt usernames before storing them I definitely meant hashing it, not encrypting it. If we also have a displayed name, there there is no usability sacrifice is there?