200 reputation
9
bio website linkedin.com/in/eranmedan
location United States
age 36
visits member for 2 years, 1 month
seen Apr 11 at 15:32

Tech Lead at NICE Actimize

  • Java, Scala, JavaScript, and all that is web
  • Data mining and fraud detection

Nov
22
comment Reset password - should I prevent abusing it?
I know saying thanks is a newbie thing to do, but it's thanksgiving here, so Thanks!
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks, and thinking that so many websites still store plain passwords, only a part of these hash them, and only a part of these also salt them, and a large part use MD5 or SHA-1, which all now seem from reading here - very easy to crack. I'm going to use a random password generator for every new website I sign up to, chances are that whoever wrote it, doesn't read this site.
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks @tylerl. so it seems that the "slowness" factor between sha256 and md5 is not mind blowing, and not even an order of magnitude apart. This starts to clear up for me the reason why bcrypt is popular then. But I still wonder, does simply iterating a large number of md5's / sha1s roughly equivalent to using bcrypt or PBKDF2?
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks :) that pretty much explains it. One thing I still don't get, if I do 10000s of SHA-1 iterations, is it still bad? isn't that the way PBKDF2 does the work factor? or am I completely mixing non-related things together?
Nov
21
awarded  Scholar
Nov
21
accepted Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Nov
21
comment Reset password - should I prevent abusing it?
I thought security questions are deprecated and discouraged (e.g. very easy to obtain using social engineering, or simply finding your trail in social networks, e.g. anyone can know someone's mother maiden name if they really want to find)
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
@Polynomial this is exactly the missing part of what I was looking for, thanks for clarifying, changed my code to use PBKDF2 instead of SHA-1
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks, What I'm trying to understand is this: Is iterating 1000 times on SHA-1 / SHA-256 considered "safe" for password hashing? Or should I move to PBKDF2 / bcrypt?
Nov
21
asked Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Nov
21
comment Reset password - should I prevent abusing it?
Thanks for reminding me I need to throttle failed login attempts, which is whole other question
Nov
21
asked Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Nov
21
awarded  Student
Nov
21
comment Reset password - should I prevent abusing it?
Thanks, this is great and answers my question very well. I have some follow up questions that came up reading your answer: 1) why do I need to add the email on the reset link? is that to avoid brute guessing reset links? (not just need to guess a UUID, but also the related email) 2) is it really possible to brute force a UUID that has 1 hour expiration? is it statistically possible? (e.g. user issues millions of reset password requests for the same email and at the same time tries to guess a UUID that will match?
Nov
21
asked Reset password - should I prevent abusing it?
Sep
30
awarded  Supporter
Sep
8
awarded  Autobiographer