200 reputation
9
bio website linkedin.com/in/eranmedan
location United States
age 36
visits member for 2 years, 1 month
seen Apr 11 at 15:32

Tech Lead at NICE Actimize

  • Java, Scala, JavaScript, and all that is web
  • Data mining and fraud detection

Apr
18
comment How was this token decoded?
p.s. should this question move to crypto.stackexchange.com? in any case if it can be improved by any way, please leave a comment / edit
Jan
4
comment What is the severity of a fake certificate?
Thank you! you helped a lot to clear my blurry grasp on this :)
Jan
4
comment What is the severity of a fake certificate?
Thanks, so if I understand correctly, a legit certificate can actually protect me somehow from man in the middle attacks / DNS hijacking? (e.g. as long as the certificate is not hacked, then it will show as invalid if someone impersonates the target site?)
Jan
3
comment What is the severity of a fake certificate?
Thanks, In other words, this can be used to redirect Google search results for example if some government wishes to censor something if I understand correctly? So I assume your comment about DNSSEC is related to having the DNS server be also "certified" so it's a real one and not one I created on a coffee shop open WiFi or something, did I get it right?
Dec
4
comment How do certification authorities store their private root keys?
Sorry, I used my time machine and checked, your Quantum computer has a flaw, it turned into a dead cat
Nov
30
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
You can hash all you want, but if you use MD5/SHA-1 (fast algorithms) and don't enforce password policy, any newbie hacker with a dictionary can crack most passwords using brute force on a strong EC2 instance in a few minutes / hours / days (depends on average password length and number of users) all under 100$. Or if you don't salt them then it's even easier using rainbow tables. Linked-in used one way hashes without salt, and got most password cracked when the database leaked. But the real issue is not passwords, all you need is the CEO's assistant to click on a malware link and your are in.
Nov
22
comment Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Thanks, Used to be a sworn .NET guy, but I have long ago converted to Java, (then to Scala) but thanks to things like TypeScript, F# etc, I'm starting to think checking back the other side...
Nov
22
comment Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Hm... interesting, I wonder why not do a sleep() timer than, is it simply because it will kill my threadpool on a DDOS?
Nov
22
comment Reset password - should I prevent abusing it?
I know saying thanks is a newbie thing to do, but it's thanksgiving here, so Thanks!
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks, and thinking that so many websites still store plain passwords, only a part of these hash them, and only a part of these also salt them, and a large part use MD5 or SHA-1, which all now seem from reading here - very easy to crack. I'm going to use a random password generator for every new website I sign up to, chances are that whoever wrote it, doesn't read this site.
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks @tylerl. so it seems that the "slowness" factor between sha256 and md5 is not mind blowing, and not even an order of magnitude apart. This starts to clear up for me the reason why bcrypt is popular then. But I still wonder, does simply iterating a large number of md5's / sha1s roughly equivalent to using bcrypt or PBKDF2?
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks :) that pretty much explains it. One thing I still don't get, if I do 10000s of SHA-1 iterations, is it still bad? isn't that the way PBKDF2 does the work factor? or am I completely mixing non-related things together?
Nov
21
comment Reset password - should I prevent abusing it?
I thought security questions are deprecated and discouraged (e.g. very easy to obtain using social engineering, or simply finding your trail in social networks, e.g. anyone can know someone's mother maiden name if they really want to find)
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
@Polynomial this is exactly the missing part of what I was looking for, thanks for clarifying, changed my code to use PBKDF2 instead of SHA-1
Nov
21
comment Is there a table that compares hashing algorithms by speed, relatively (machine independent)
Thanks, What I'm trying to understand is this: Is iterating 1000 times on SHA-1 / SHA-256 considered "safe" for password hashing? Or should I move to PBKDF2 / bcrypt?
Nov
21
comment Reset password - should I prevent abusing it?
Thanks for reminding me I need to throttle failed login attempts, which is whole other question
Nov
21
comment Reset password - should I prevent abusing it?
Thanks, this is great and answers my question very well. I have some follow up questions that came up reading your answer: 1) why do I need to add the email on the reset link? is that to avoid brute guessing reset links? (not just need to guess a UUID, but also the related email) 2) is it really possible to brute force a UUID that has 1 hour expiration? is it statistically possible? (e.g. user issues millions of reset password requests for the same email and at the same time tries to guess a UUID that will match?