eckes

less info
stack exchange network profile network profile
131 reputation
3
bio website bernd.eckenfels.net
location Karlsruhe, Germany
age 41
visits member for 6 months
seen Jan 29 at 18:36
stats profile views 3

Chief Architect at a german ISV. Java Guru, IT-Security freak, married and pirate.


7 Comments

suggestions reviews revisions comments badges posts accepts all
Jan
5
 comment Preventing user supplied javascript from posting to external server
Actually CSP has the "connect-src" attribute, but yes the best separation can be achieved by downloading the plugin from its own origin/domain.
Dec
21
 comment How can I explain SQL injection without technical jargon?
I typically try to skip the details if it is not a technical user but only describe the risk and effect. "If $software has a bug which allows SQL injection an attacker can smuggle commands into your database to destroy or modify data or passwords." Why would you want to go to the details of sql parsing, prepared statements and quoting.
Dec
21
 comment Resource consumption attacks against algorithms
Actually the Apache Range Header bug is not a hash collission problem. Apache had hash problems as well.
Dec
21
 comment How secure is opening an incoming port for a java application?
No, it is not the "Java vulnerability" you need to care here about but the actual java application which is started with java. For example you can write a Java appication which deletes a file every time you receive a UDP message. Or allows upload of files and executes it. So basically the risk depends on the java program. Java Runtime Bugs would come on top of that (but are rather unlikely for simple udp ports).
Nov
22
 comment How to securely hash passwords?
It is not "most common" or "best". Most common are crypt() family hashes or even unsalted variants. KDFs are not designed for that and therefore be used with care. Dont know what the "best" is (it depends on your goals I guess), but bcrypt and scrypt or even sunmd5 is more purpose build.
Nov
22
 comment Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?
For most salted encryption schemes which are used out there in the wild the salt is not hidden. Thats not a helpfull restriction. You cannot legitimately re-produce the hashing if you dont know the salt.
Nov
22
 comment Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?
I disagree on the "nist-sp800-132" approves PBKDF2 for "hashing and storing passwords". It actually talks about using PBKDF2 as a KDF for deriving data protection keys which are used to encrypt stored data.