Reputation
33,517
Next tag badge:
600/400 score
77/80 answers
Badges
2 38 88
Newest
 Good Answer
Impact
~2.0m people reached

Jun
20
revised In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
added 236 characters in body
Jun
20
revised In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
added 236 characters in body
Jun
20
answered Why don't mobile operators blacklist stolen phones using their IMEI?
Jun
20
answered In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
Jun
19
reviewed Close How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party?
Jun
19
reviewed Leave Closed Proccess to exploit an OS vulnerability
Jun
19
answered My cookies have been stolen. What to do?
Jun
19
comment My cookies have been stolen. What to do?
Find the cookie monster and ask for them back?
Jun
19
answered Is providing a website password over the phone any less secure than other identifying information?
Jun
18
comment Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
@ThomasPornin - fair point, I update to indicate that it is simply more resistant to brute force, though both are currently well in to not brute forceable territory. As I understand it, certain exotic attacks could reduce the bits substantially though (such as certain quantum attacks), but higher key length should reduce the impact of this type of attack (even if it make it slightly more vulnerable to others).
Jun
18
revised Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
added 90 characters in body
Jun
18
comment How easy is it, really, to be hacked as an average user?
You should add "patches up to date" to that list, but then, you really aren't an average user with all those criteria set, but rather a security conscious one.
Jun
18
answered Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
Jun
18
reviewed No Action Needed Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
Jun
18
answered What is the web of trust?
Jun
18
reviewed No Action Needed What is the web of trust?
Jun
18
reviewed Close How does Java connect via SSL to a server without me providing any private/public key for the communication?
Jun
18
reviewed Leave Open How easy is it, really, to be hacked as an average user?
Jun
18
comment Is it secure to use email to add content to a website?
I can send an e-mail from any address to any address and it will go through unless both the recipient and sender are following one or more optional security features. The full spectrum of those technologies is a couple questions worth of info, but look in to things like DKIM and SPF.
Jun
18
comment Is a long salt usually sufficient for security purposes, even with MD5?
@user2175923 - It seems you don't understand the attack you are trying to protect against. The attack you are describing in your question is where an attacker already HAS the hash values stored in the DB for each user and is trying to figure out the password from that. They hash a bunch of possible values and look for a match. If they are able to even attempt this attack, it means that the DB had to be compromised to get the hash values. It would be silly to assume they didn't also grab the salt values while they were there. Salting is a protection for in case the DB is compromised.