2,065 reputation
516
bio website
location
age
visits member for 2 years, 4 months
seen 16 hours ago

just a guy who spends all of his time on the computer


1d
comment Good password hashing algorithm compatible with PHP and Linux apps
Just use bcrypt
Dec
18
answered Is HTTPS redirecting to HTTP a vulnerability?
Dec
15
comment prevent session hijacking in PHP
It sounds like you are vulnerable to SQLi then. If the username contains sql code, it will run if concatenated in like youre doing.
Dec
15
answered prevent session hijacking in PHP
Nov
16
comment Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?
@Curious last pass had a press release that the bugs in this paper were fixed long before the paper was published. blog.lastpass.com/2014/07/a-note-from-lastpass.html
Nov
12
comment Use of JavaScript by LastPass to encrypt & decrypt the password database a secure approach?
@Curious and if Microsoft/Apple/Richard Stallman/Whomever is malicious they can access all your data too. You can audit the website or the lastpass command line interface to determine how it works and whether or not you feel comfortable using it.
Nov
5
comment Similarity comparisons with hashed passwords possible?
Oh I somehow missed that. I've seen companies pre-compute similar hashes and store them. The short answer is nobody knows but the server admins...but it is possible that they are plaintext
Nov
5
comment Similarity comparisons with hashed passwords possible?
They could just be storing the last 8 hashes...
Nov
4
comment My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do?
schroeder, you can always sue. However to win a negligence suit one needs to prove an actual loss
Sep
24
awarded  Autobiographer
Sep
24
awarded  Custodian
Sep
24
reviewed Reject Why does malware periodically check google.com
Sep
24
reviewed Approve Four-factor authentication
Sep
4
comment Does public key encryption/decryption speed actually matter?
It sure matters when you have billions of connections...The computational overhead adds up.
Sep
4
comment Is information security based entirely on mathematics
Encryption is not the only aspect of information security. Information Security is very broad and there are tons of InfoSec things that have nothing to do with math. How much math do you need to secure a network. Probably not much. If you go down deep enough, everything is a 1 or a 0, but that doesn't mean computer problems are math problem.
Aug
1
awarded  Yearling
Jul
19
answered Want to build a password manager using OpenPGP.js
Jul
19
comment Want to build a password manager using OpenPGP.js
@David the use cases of browser crypto that are in the matasano article are not consistent with a what a password manager does. I've read Thomas Ptacek (the author) saying ~"no matter which you choose, you should be using A password manager~" many times...
Jun
8
revised If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?
added 198 characters in body
Jun
8
answered If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?