858 reputation
615
bio website
location
age
visits member for 3 years, 1 months
seen Apr 19 at 17:52

Feb
6
comment Sharing passwords through email can be considered insecure?
plaintextoffenders.com/about says "sending the password via email ... is bad." That seems to directly contradict "For most webs and services it is ok to send you a clear password ... to your e-mail." Did you maybe intend to put a "not" somewhere in that sentence?
Feb
6
comment Sharing passwords through email can be considered insecure?
Have you heard of plaintextoffenders.com/about ?
Feb
3
comment Does server RAM count as storage for PCI Compliance?
+1 agree. Maybe it would be better if the credit card data went directly from the customer to a PCI-compliant server directly to the payment processor (as with Stripe, Square, Chargify, etc.), rather than making a detour through some other server.
Jan
24
comment Where is the salt on the OpenSSL AES encryption?
related: "Is there a standard for OpenSSL-interoperable AES encryption?"
Jan
13
comment Increase the security of an already stored password hash
related: Convert old and busted password encryption to something sensible
Aug
5
comment Is using a public-key for logging in to SSH any better than saving a password?
If "not using a passphrase isn't smart", then why does the OpenSSL documentation specifically say that "it may be a good thing to avoid protecting it with a password" ? (Should I ask this as an independent question?)
May
13
comment how safe is the 256 bit encryption used in bank transactions
@GuySirton: While many people would be surprised if it turns out that factoring is NP-hard, is there any proof that factoring is definitely not NP-hard?
Dec
9
comment how to stop write downs
Is this a duplicate of Are there a standard method(s) for me to give someone else read-only access to my data?
Nov
22
comment iOS app - hash user password in-app or on-server?
@Polynomial: All websites that use "HTTPS" already somehow handle certificate distribution and management. Are you seriously saying that websites using "HTTPS" are nonstandard and too inconvenient for typical users?
Nov
19
comment Petraeus scandal - what would have been a better way to communicate electronically
Could you name or link to a few of these of secure setups?
Aug
27
comment Hash function change
@CodesInChaos: Are you thinking of Do I have to recompute all hashes if I change the work factor in bcrypt? ?
Aug
16
comment Is there a standard for printing a public key as a barcode?
"QR and Encryption" suggests putting the message digest of a public key in a QR code on a business card.
Aug
16
comment Secure memcpy for pure C
Or are you maybe referring to Bernstein's netstring format?
Aug
16
comment Secure memcpy for pure C
That link doesn't work for me. Perhaps it has moved somewhere closer to a or b ?
Aug
10
comment Is there a method of generating site-specific passwords which can be executed in my own head?
The technique described by Yann Esposito and John would work great, if only there were a hash function that one can compute without a computer?.
Aug
9
comment Oldest security feature still in active use
-1: The one-time pad sounds pretty simple to us today, and so it would be a good guess that it's one of the earliest. However, it was first described in 1882; there are many other ciphers that are first described centuries or millenia earlier.
Aug
9
comment Has cryptography reached the development level where social engineering is the only reliable method of attack?
+1 for mentioning OS vulnerability
Jul
28
comment What is the best way to securely keep clear passwords?
-1: This doesn't seem to apply to Cyril's question -- perhaps you meant to post it in response to some other question? Cyril's application is apparently running on a middleware server, talking to the user's web browser on one side and talking to the database server on the other side. The middleware app needs to send some sort of "password" to get data from the database server. If the middleware app only has a "salted hash" of the password, how can it get data from the database server?
Jul
17
comment Storing password hashes without a correlation to the user account
-1: By storing salted hashes in my table, there already exists an infinite number of passwords for EACH account that match that hash. Once I have infinity, multiplying it by a few million doesn't make it any bigger. (I admit that's not very intuitive).
Jul
9
comment Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?
related: Does NIST really recommend PBKDF2 for password hashing?