716 reputation
613
bio website blog.ircmaxell.com
location New Jersey
age 31
visits member for 3 years, 10 months
seen Oct 15 at 9:37

I'm a developer who focuses in and with experience in and . I also specialize in , , and general development methodology and practice. I also have experience administrating both Windows and Linux machines.

You know you understand when everything not only makes sense, everything feels right

Check out my Resume over on Careers.StackOverflow


Sep
10
comment Recommended # of iterations when using PKBDF2-SHA256?
It does come out to 241ms. In fact, if you plug 8ms into the formula, you get approximately 23 hours out as "attacker patience". Which is a whole lot less than a month (for a single 32 bit entropy password)... And low enough where the recommended value of 8ms should likely be raised.
Aug
18
awarded  Enlightened
Aug
18
awarded  Nice Answer
Aug
18
awarded  Yearling
Aug
18
answered Has scrypt been broken, finally?
Jun
22
awarded  Notable Question
Feb
8
awarded  Scholar
Feb
8
accepted Timing Safe String Comparison - Avoiding Length Leak
Feb
5
comment Timing Safe String Comparison - Avoiding Length Leak
So, would something as an analog to the above (even with its potential length leak) be sufficient and beneficial in your opinion? Seems to be the general trend here.
Feb
5
awarded  Nice Question
Feb
3
comment Timing Safe String Comparison - Avoiding Length Leak
@mikeazo: I figured it was crypto simply due to it normally applying to practical implementations of crypto. If you could move it, it would be much appreciated! Thanks!
Feb
3
comment Timing Safe String Comparison - Avoiding Length Leak
For the record, this is related to an RFC for PHP to add a safe comparison function to core.
Feb
3
asked Timing Safe String Comparison - Avoiding Length Leak
Aug
24
awarded  Announcer
May
10
awarded  Yearling
May
1
awarded  Popular Question
Apr
12
awarded  Good Question
Mar
15
awarded  Commentator
Mar
15
comment Is request signing (digesting the request body) in a REST API necessary?
You might get better luck asking this question on security.stackexchange
Mar
13
comment Is $_SERVER[ ] a safe source of data in PHP?
@Rook: Minor note, but relying upon REMOTE_ADDR requires that your web server be properly configured as well. Sometimes it can be controlled...