Reputation
34,161
Next tag badge:
617/400 score
77/80 answers
Badges
2 38 91
Newest
 Nice Answer
Impact
~2.2m people reached

Jun
26
answered Why are brute-force password-cracking attacks not automatically detected and thwarted?
Jun
24
reviewed Close Does using a non Nexus/Google Play Editon Android device have a higher security risk?
Jun
24
comment How to sync with multiple authentication services?
I'm not even sure such a thing exists. It should be able to since LDAP just needs to be able to have a directory and it should be possible to build a directory off of accounts on other services, but I have never gone digging for such a thing before. That's why I only commented.
Jun
23
comment How to sync with multiple authentication services?
It doesn't necessarily have to be single sign on, but you need an LDAP service that is able to check multiple types of authentication and return the proper results.
Jun
23
comment Crack Unknown Encryption
@SQB - If it wasn't too broad, it would probably be on topic there. But this question is an entire field of study, not a Q/A topic. "How do I break generic encryption?" takes multiple text books and college classes, not a several paragraph answer.
Jun
23
comment Crack Unknown Encryption
@SQB - it is too long to be a GUID. It is not a good question for SE or Crypto. It is too broad to discuss general decryption of an unknown algorithm and is off topic on either site. It does appear that it is an identifying token rather than an encrypted message though from those search results.
Jun
23
answered Mobile authentication
Jun
23
answered Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?
Jun
23
reviewed No Action Needed Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why?
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - presumably the secret phrase SHOULD be protected by the password, otherwise it is completely worthless. I'm assuming that you need the password in the second step because you need to be able to get the phrase to check against. If that is the case, you could verify the username and password by using the normal hash operation (or by decrypting the phrase) and you could then store the phrase in session until the second step. This prevents having to hold the password in memory.
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - it probably needs to be two calls. You don't want to leak the length of the passphrase to an attacker who doesn't have the password yet. As an alternative to storing the password in session, decode the passphrase and store the phrase instead.
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - what it really is is theater. The level of randomness that most people are going to put in to choosing a phrase is likely pretty small, so the actual entropy of such an additional check is going to be pretty small, even for the length. A little social engineering is also likely to overcome it as people don't understand how the security measure is supposed to work. It might be slightly better than no additional info being needed over the phone, but not by much, it is mostly for show so that people FEEL like their money is being protected. Just like "enhanced" airport security.
Jun
20
revised In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
added 236 characters in body
Jun
20
revised In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
added 236 characters in body
Jun
20
answered Why don't mobile operators blacklist stolen phones using their IMEI?
Jun
20
answered In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
Jun
19
reviewed Close How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party?
Jun
19
reviewed Leave Closed Proccess to exploit an OS vulnerability
Jun
19
answered My cookies have been stolen. What to do?
Jun
19
comment My cookies have been stolen. What to do?
Find the cookie monster and ask for them back?