BlueRaja - Danny Pflughoeft
Reputation
694
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 12
Newest
 Scholar
Impact
~31k people reached

  • 0 posts edited
  • 0 helpful flags
  • 127 votes cast
21h
awarded  Scholar
21h
accepted How does LastPass know that Microsoft.com uses the password for Live.com?
21h
comment How does LastPass know that Microsoft.com uses the password for Live.com?
@schroeder: Whether a question is "vendor support" or not shouldn't depend on the answer. The answer here happens to be "they hard-coded it," but I had no way of knowing that without knowing the answer. It could very easily have been an HTML or HTTP feature I wasn't aware of.
1d
asked How does LastPass know that Microsoft.com uses the password for Live.com?
Aug
7
comment Why do phishing emails have spelling and grammar mistakes?
Yeah this is a nice thought, but I'm sure the grammar mistakes aren't that nefarious. English is a hard language, and it's not most people's first language.
Jul
16
comment Is it safe to send SSL certificates via email?
It's called the public key for a reason :)
Jul
13
awarded  Autobiographer
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@JasonCoyne: I challenge your claim that "a length of 8 [..] will have the password cracked very easily." Say the user uses only upper- and -lower-case letters, no numbers or special characters. And say your PBKDF2 is set up so the server takes 0.3s to hash one password. And say the attackers have a botnet 1000x more powerful than your server. Then it will still take an attacker over an expected 250 years to brute-force that one user's password. Since you are salting, that's 250 years per user.
Jul
11
comment Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
@JasonCoyne: 16 letters is way too high for the average user. Make it more reasonable (7-8 letters) and use bcrypt with an extremely high number of rounds, if you're that worried about it. That way the general security rests on your shoulders, and can be increased later if necessary without inconveniencing the user.
May
27
comment Can attackers get anything with DoS attacks except crashing the service?
If I am your competitor in <whatever business>, by bringing your servers down I am likely to gain some of your customers.
May
9
comment Are open wireless networks unencrypted?
@BrianGordon: The same way SSL does it? I realize Wifi AP's don't use signed keys, but OP doesn't know that, and it's feasible that they could.
Apr
23
comment The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer?
According to this page, detecting a VM is not as trivial as you make it sound (that link comes from a comment in your SO link, with the claim that the techniques on that page don't work correctly).
Apr
18
comment Why do some bank websites use passwords that are not case sensitive?
Related: Are there any valid reasons for disallowing characters and limiting the length of passwords?
Apr
2
awarded  Nice Answer
Mar
25
awarded  Pundit
Feb
23
awarded  Yearling
Nov
24
comment “Diffie-Hellman Key Exchange” in plain English
I think it's worth mentioning that the reason this is secure is that, unlike normal log(x), the modular log(x) is thought to be hard to compute. Otherwise we could just do log_g(A) and log_g(B) to get a and b.
Sep
4
comment How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?
The same problem exists for all technologies - a better solution is usually available, but no one uses it because no one else uses it. And the solution tends to be the same too - either everyone agrees to a standard, or some big player in the field starts supporting it and convinces their customers it's what they want, at which points all their competitors will follow suit.
Sep
3
comment Why is password hashing considered so important?
@Andy actually newer hashes tend to be faster. SHA-3 was specifically chosen because it's so fast (well, and because it's so different from SHA-2..)
Jun
7
awarded  Citizen Patrol