meta user
network profile
| bio | website | linkedin.com/in/eranmedan |
|---|---|---|
| location | United States | |
| age | 35 | |
| visits | member for | 9 months |
| seen | Apr 18 at 15:20 | |
| stats | profile views | 11 |
Tech Lead at NICE Actimize
- Java, Scala, JavaScript, and all that is web
- Data mining and fraud detection
- Secretly wants to be a Ruby on Rails guy
|
Apr 18 |
accepted | How was this token decoded? |
|
Apr 18 |
comment |
How was this token decoded? p.s. should this question move to crypto.stackexchange.com? in any case if it can be improved by any way, please leave a comment / edit |
|
Apr 18 |
asked | How was this token decoded? |
|
Jan 4 |
comment |
What is the severity of a fake certificate? Thank you! you helped a lot to clear my blurry grasp on this :) |
|
Jan 4 |
comment |
What is the severity of a fake certificate? Thanks, so if I understand correctly, a legit certificate can actually protect me somehow from man in the middle attacks / DNS hijacking? (e.g. as long as the certificate is not hacked, then it will show as invalid if someone impersonates the target site?) |
|
Jan 4 |
accepted | What is the severity of a fake certificate? |
|
Jan 3 |
comment |
What is the severity of a fake certificate? Thanks, In other words, this can be used to redirect Google search results for example if some government wishes to censor something if I understand correctly? So I assume your comment about DNSSEC is related to having the DNS server be also "certified" so it's a real one and not one I created on a coffee shop open WiFi or something, did I get it right? |
|
Jan 3 |
asked | What is the severity of a fake certificate? |
|
Dec 19 |
awarded | Citizen Patrol |
|
Dec 4 |
comment |
How do certification authorities store their private root keys? Sorry, I used my time machine and checked, your Quantum computer has a flaw, it turned into a dead cat |
|
Nov 30 |
awarded | Teacher |
|
Nov 30 |
comment |
VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us? You can hash all you want, but if you use MD5/SHA-1 (fast algorithms) and don't enforce password policy, any newbie hacker with a dictionary can crack most passwords using brute force on a strong EC2 instance in a few minutes / hours / days (depends on average password length and number of users) all under 100$. Or if you don't salt them then it's even easier using rainbow tables. Linked-in used one way hashes without salt, and got most password cracked when the database leaked. But the real issue is not passwords, all you need is the CEO's assistant to click on a malware link and your are in. |
|
Nov 30 |
awarded | Critic |
|
Nov 30 |
answered | VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us? |
|
Nov 22 |
comment |
Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha? Thanks, Used to be a sworn .NET guy, but I have long ago converted to Java, (then to Scala) but thanks to things like TypeScript, F# etc, I'm starting to think checking back the other side... |
|
Nov 22 |
awarded | Commentator |
|
Nov 22 |
comment |
Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha? Hm... interesting, I wonder why not do a sleep() timer than, is it simply because it will kill my threadpool on a DDOS? |
|
Nov 22 |
accepted | Reset password - should I prevent abusing it? |
|
Nov 22 |
comment |
Reset password - should I prevent abusing it? I know saying thanks is a newbie thing to do, but it's thanksgiving here, so Thanks! |
|
Nov 21 |
comment |
Is there a table that compares hashing algorithms by speed, relatively (machine independent) Thanks, and thinking that so many websites still store plain passwords, only a part of these hash them, and only a part of these also salt them, and a large part use MD5 or SHA-1, which all now seem from reading here - very easy to crack. I'm going to use a random password generator for every new website I sign up to, chances are that whoever wrote it, doesn't read this site. |
