295 reputation
16
bio website
location
age
visits member for 2 years, 2 months
seen Sep 27 at 23:16

22h
awarded  Nice Answer
Sep
17
comment How safe is to secure sensitive content by URL with MD5 hash and no other authorization?
Depending on whether the attacker can guess the input to the hash, it ranges from virtually instantly, to basically impossible.
Sep
17
comment Security of a Random Password
Assuming you don't reuse your password. If you do then all bets are off. Also rubber hose cryptography. Also no hash fonction known today is likely to be unbroken in 100 years.
Sep
17
comment Cookie Tossing explained
Facetious Cookie tossing is being sick. By being sick on someone whilst they are in an active session they will often leave the computer unattended without logging out, allowing for session hijacking. This can be prevented by having a proximity token to access the computer. Preferably the screen would darken immediately on loss of connection to the token.
Sep
17
answered Is it possible to have a text message that I didn't send appear on my smart phone making it look as if I did send the text?
Sep
2
awarded  Critic
Jul
21
comment Why allow access without an access token but deny access with an invalid access token?
This could also allow an attacker to check token validity / expiration. Not necessarily a problem but it could allow an attacker to calculate how long issued tokens remain valid. I'm trying to dream up scenarios where this is useful but I'm drawing a blank.
Mar
26
comment When and where do I hash a password?
That works too, it gives fewer options for salting from what I recall.
Mar
26
comment When and where do I hash a password?
The reducing hash means the attacker can't just capture the hash off the wire and pass that to the server. He has to break the password. In this case the iteration is not for increasing the attackers work, but for preventing replay attacks. The first hash in the chain should probably be something slow, and the remainder of the hashes fast. The beauty of the scheme is that the client can use whichever hash fiction he wishes initially, as long as the last 10,000 iterations are what the server expects.
Mar
26
revised When and where do I hash a password?
Clarified poor explanation, caused by loose use of terminology.
Mar
26
comment When and where do I hash a password?
On account creation the server is given the 10000 times hashed password. On the subsequent login the server is given the 9,999 times hashed password, which it then hashes once to check it is correct. If it matches the 10,000 times hashed password then the server authenticates the client. The server then replaces it's copy of the 10,000 times hashed password with the 9,999 times password which it was sent by the user. It never reverses the hash, it simply checks if the user supplied hash matches. insert unnecessary disparaging comment here
Mar
25
comment When and where do I hash a password?
The goal with this strategy is to assure the client that the server, whether maliciously or accidentally, cannot leak his passwords, even if the server is always malicious. The client can guarantee the server cannot leak his password, because the server never sees it, not even at account creation. The reducing hash means that an attacker cannot just pass the hash, because each hash is only good once. The salting scheme is necessary to prevent the attacker from forging a login page with a low hash number to obtain a large hash chain. I saw this in a paper I read years ago, I'll look for it.
Mar
25
answered When and where do I hash a password?
Feb
21
awarded  Yearling
Feb
21
revised How can I be sure that my browser does not exfiltrate my passwords to some server?
Clarified title.
Feb
21
comment A service that claims beyond army level encryption
If a large block of people began using a system like this for political dissent it's unlikely China would block the service. Far more likely they would break into the servers and use the site as a list of people to watch. The only way to prevent this is to support libertarian government (just for the record I'm not a libertarian, whilst I think they are the only government type that would reliably avoid doing this kind of thing, they'd be pretty terrible at governance.) Underground political dissent is always dangerous, that we all could have the strength of Gandhi.
Feb
21
suggested suggested edit on How can I be sure that my browser does not exfiltrate my passwords to some server?
Feb
21
awarded  Commentator
Feb
21
comment A service that claims beyond army level encryption
From a moral perspective, it's not a valid asset to read all communications. Many countries use this information to discriminate against minorities. Even if the US was the perfect nation that never abused their minorities (har har) they lose any moral authority to tell China not to use it for political suppression (as the US uses it to 'repress' Islamic extremists). And yes, the US does put pressure on services that do not comply with their spying, for example Lavabit.
Feb
21
comment How can I be sure that my browser does not exfiltrate my passwords to some server?
You would also need to check that your browser was the browser you thought it was, i.e. build it yourself or check build hashes of others. @SylapAliyev