26,080 reputation
22661
bio website
location Troy, NY
age 30
visits member for 1 year, 11 months
seen 4 hours ago

Jul
1
comment Why do ATMs accept any PIN?
One minor side note, the PIN COULD be verified before hand and sent again with transaction amount, but this would require more communication. It isn't like sending the encrypted PIN once prevents being able to send the PIN + transaction amount later. It still makes sense not to though as it makes it take longer to execute an attempt if they have to go through setting up the transaction as well.
Jul
1
comment Best approach for storing banking information
I'm a little confused when you talk about hashing the bank details. That won't allow retrieval of the details so it doesn't make a whole lot of point in storing them. PBKDF2 uses a hash of the password the user inputs to generate an encryption key, it doesn't hash the actual data being stored. The salt that was used with the user's password to generate the key has to be kept, but it doesn't have to be associated with the data necessarily.
Jun
28
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
@kjo that can still be emulated unless the key is protected. This is the idea behind an hsm, but such things aren't cheap or easy to work with.
Jun
27
comment How can I watch porn, safely, and not get a virus? (and not infect corporate data also)
@skytreader - is it bad that I'm scared to click the link? Edit: Apparently not.
Jun
27
comment Accessing Chrome and Gmail on a stolen drive
Yes. They could clone your session unless it was IP locked.
Jun
26
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
@kjo - the decoded value has to be something that the application can recognize as valid too if it is all that it has to go on. If it isn't recognizable, then the login process won't know right from wrong either. The attacker can use the same approach.
Jun
26
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
@AviD - fair point, is "Reasonably often" more agreeable with reality?
Jun
24
comment How to sync with multiple authentication services?
I'm not even sure such a thing exists. It should be able to since LDAP just needs to be able to have a directory and it should be possible to build a directory off of accounts on other services, but I have never gone digging for such a thing before. That's why I only commented.
Jun
23
comment How to sync with multiple authentication services?
It doesn't necessarily have to be single sign on, but you need an LDAP service that is able to check multiple types of authentication and return the proper results.
Jun
23
comment Crack Unknown Encryption
@SQB - If it wasn't too broad, it would probably be on topic there. But this question is an entire field of study, not a Q/A topic. "How do I break generic encryption?" takes multiple text books and college classes, not a several paragraph answer.
Jun
23
comment Crack Unknown Encryption
@SQB - it is too long to be a GUID. It is not a good question for SE or Crypto. It is too broad to discuss general decryption of an unknown algorithm and is off topic on either site. It does appear that it is an identifying token rather than an encrypted message though from those search results.
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - presumably the secret phrase SHOULD be protected by the password, otherwise it is completely worthless. I'm assuming that you need the password in the second step because you need to be able to get the phrase to check against. If that is the case, you could verify the username and password by using the normal hash operation (or by decrypting the phrase) and you could then store the phrase in session until the second step. This prevents having to hold the password in memory.
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - it probably needs to be two calls. You don't want to leak the length of the passphrase to an attacker who doesn't have the password yet. As an alternative to storing the password in session, decode the passphrase and store the phrase instead.
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
@acfrancis - what it really is is theater. The level of randomness that most people are going to put in to choosing a phrase is likely pretty small, so the actual entropy of such an additional check is going to be pretty small, even for the length. A little social engineering is also likely to overcome it as people don't understand how the security measure is supposed to work. It might be slightly better than no additional info being needed over the phone, but not by much, it is mostly for show so that people FEEL like their money is being protected. Just like "enhanced" airport security.
Jun
19
comment My cookies have been stolen. What to do?
Find the cookie monster and ask for them back?
Jun
18
comment Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?
@ThomasPornin - fair point, I update to indicate that it is simply more resistant to brute force, though both are currently well in to not brute forceable territory. As I understand it, certain exotic attacks could reduce the bits substantially though (such as certain quantum attacks), but higher key length should reduce the impact of this type of attack (even if it make it slightly more vulnerable to others).
Jun
18
comment How easy is it, really, to be hacked as an average user?
You should add "patches up to date" to that list, but then, you really aren't an average user with all those criteria set, but rather a security conscious one.
Jun
18
comment Is it secure to use email to add content to a website?
I can send an e-mail from any address to any address and it will go through unless both the recipient and sender are following one or more optional security features. The full spectrum of those technologies is a couple questions worth of info, but look in to things like DKIM and SPF.
Jun
18
comment Is a long salt usually sufficient for security purposes, even with MD5?
@user2175923 - It seems you don't understand the attack you are trying to protect against. The attack you are describing in your question is where an attacker already HAS the hash values stored in the DB for each user and is trying to figure out the password from that. They hash a bunch of possible values and look for a match. If they are able to even attempt this attack, it means that the DB had to be compromised to get the hash values. It would be silly to assume they didn't also grab the salt values while they were there. Salting is a protection for in case the DB is compromised.
Jun
18
comment Is it secure to use email to add content to a website?
Yes, but you just ruled it out as a possibility. Signing is the only option. For some senders it MIGHT be possible if they use TLS and use some anti-spam features that validate the server, but not all senders do this, so it isn't reliable, nor is it particularly trivial to validate.