30,384 reputation
23277
bio website
location Troy, NY
age 30
visits member for 2 years, 2 months
seen 10 hours ago

1d
answered Encrypted retrievable password
1d
comment Encrypted retrievable password
@MatthewPeters - fair enough, happens to us all.
1d
comment Encrypted retrievable password
@BustedSanta, does the decrypted password need to be available offline (ie, when the user isn't logged in)?
1d
answered Can a botnet be used to effectively break encryption keys?
1d
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - oohhh, that's YOUR product that you handily didn't disclose your affiliation with in the comment. Please tell me you are at least using a randomized GUI pin entry that doesn't link to key press events so that it is protected against basic loggers. (Which would be the reason I put the (almost) in the above comment.) Otherwise, the feature is completely worthless (and actually a hindrance to users).
1d
comment Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
@Nowen - which would still be entered on a compromised device and thus provide 0 to almost 0 additional security. It only prevents a non-persistent remote exploit of the device, which is a very, very small use case of protection. More thoroughly, it only helps you when there isn't key logging on the device, in which case the password for the site wouldn't be compromised and the 2FA token compromise wouldn't matter. There is literally almost no situation (if any) that WiKID's password on the token helps anything.
1d
answered Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?
2d
reviewed Close Protected excel sheet is unprotected without permission in google spreadsheet
2d
reviewed Close Should one worry about using an outdated version of Firefox?
2d
reviewed Close Penetration Testing on Thick Client Application
2d
reviewed Close Advice on if I should talk at my local user group about NIST, InfoSec etc
2d
reviewed Close bscrypt,scrypt v/s iterative SHA-x
Nov
19
revised storage of client credential on OAuth2 server
added 404 characters in body
Nov
19
answered storage of client credential on OAuth2 server
Nov
18
reviewed Close What is a DNS poisoning attack and how does it work?
Nov
18
reviewed Close How to modify and resend WiFi packets
Nov
18
reviewed Close Suggest a Security Certification
Nov
18
reviewed Close Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat?
Nov
18
reviewed Close How to remove Version Information from Encrypted OpenPGP message in Windows?
Nov
18
reviewed Close Should I Use Base64 or Unicode for Storing Hashes & Salts?