1,025 reputation
512
bio website
location
age
visits member for 2 years, 1 month
seen 2 days ago

Aug
19
comment I've heard that salt is not meant to be secret, but what if I made it secret?
@Buge What I had meant here was, there is usually going to be 1 salt stored in the code, not one for each hash. Having a unique salt for each hash may increase the time it takes for a particular brute force attack on the hash, however that is not the purpose of a salt. There might be a better way of increasing the resistance to brute force attacks by increasing the interations of your hashing algorithm. You can store salts in a database as well as in the code. The security between these two methods may be a seperate question.
Jul
17
awarded  Yearling
Jul
7
awarded  Notable Question
Mar
11
answered Isolate dual system
Dec
28
awarded  Nice Answer
Nov
1
awarded  Nice Question
Sep
5
comment Why is password hashing considered so important?
@MaciejPiechotka Thanks for bringing up the point where in the case of bruteforcing hashes in a whole unsalted databases, computational time will be reduced by not having to recompute the same hash for each password. However lets also keep in mind that 1000s or more passwords to crack may be insignificant in the future when processors become exponentially faster, or so some have forecasted.
Sep
5
comment Why is password hashing considered so important?
@Andy Thank you for providing that link for me. I'm not sure where you are going with the purpose of a salt with my comment talking about computation time effects of hashing passwords with a salt.
Aug
30
comment Why is password hashing considered so important?
@Andy Actually, salting a password won't really effect the time it takes to brute-force. That is because if someone got the hash passwords, they could probably get the salt as well.
Aug
30
answered What is “download-new.com”?
Jul
17
awarded  Yearling
May
17
answered Vulnerability testing without the use of exploits?
May
12
comment Vulnerable OS's?
In addition, Windows Server 2003 with no patches would be a good start.
Apr
17
answered How do random attackers discover websites to target?
Apr
17
awarded  Popular Question
Apr
12
answered how can you inject malicious code into an innocent-looking URL?
Apr
10
comment Is there additional security value in using passwords with words or phrases in non-English languages?
@IlmariKaronen Genius!
Apr
8
comment Is there additional security value in using passwords with words or phrases in non-English languages?
@Polynomial Technically, Passw0rd is only 8 characters! (Not "over 8")
Apr
1
answered Why improvising your own Hash function out of existing hash functions is so bad
Mar
28
comment What is zero day?
@Luc I wasn't trying to say that it had to have a patch when it was released, but rather that it could get released to the public some other way than though a patch. This method is usually a forum or a vulnerability website. exploit-db.com