1,306 reputation
512
bio website redhardsupra.blogspot.com
location Laurel, MD
age 36
visits member for 3 years, 5 months
seen yesterday

1d
comment Find out what Linux software is trying to phone home
watch is much nicer than while true; do...done
Feb
26
awarded  Good Answer
Jan
23
comment Should I decode a base64 password before hashing for storage?
I meant it for the attacker snooping on the transmission, if you see a string that looks like base64, it's trivial to extract end decode it. All that happening before he hashes things.
Jan
23
comment Should I decode a base64 password before hashing for storage?
Base64 is really easy to recognize too, the format instantly gives away what you'd want to try on it to decode it.
Jan
10
awarded  Popular Question
Dec
2
revised Taxonomy of Ciphers/MACs/Kex available in SSH?
added a link
Nov
18
awarded  Yearling
Jul
19
answered Why is unshadowing needed?
Jan
24
revised What things should a penetration tester know about databases?
more info
Jan
24
answered What things should a penetration tester know about databases?
Jan
16
comment How to crack password hashed using SSHA?
Depending on the format, you might have to convert the hash/salt to/from hex/base64 for JtR or Hashcat to work on them.
Nov
18
awarded  Yearling
Oct
26
comment Access control matrix and integrity
Biba (integrity) and Bell-La Padula (confidentiality) are 'duals' of one another, so whatever you can do with one you can do with the other.
Oct
22
comment The Creation of Secure Software Development Environments
The G in STIG stands for Guide. STIGs were originally intended as a starting point. However, since the accreditors tend to have severe tunnel vision, and hold people's feet to the fire over complete, blind compliance to the STIGs, they've become a de facto 'Law.' STIGing a box should be a mere beginning, a nice starting point to building a more secure system, not the official stopping point, with the ability of being penalized for actually improving upon it.
Oct
16
comment Enterprise IDS - Deployment & Uses
"Snort's free, sure, but your time isn't" +1 for t-shirt worthy quote ;)
Oct
9
comment security issue on storing keys and certificate on token
Even if the EEPROM is read-only, wouldn't anyone with an EEPROM reader be able to get your private key, at which moment they can pretend to be that token?
Sep
25
awarded  Nice Answer
Sep
20
comment Can DES-based hashed password be recovered if salt is known?
This is a very good explanation of DES vs descrypt, thank you.
Sep
20
answered NSA Suite A Cryptography: Security through obscurity?
Sep
7
comment Scrypt + Bcrypt = cascade hashing
I'm no crypto expert, but I've learned enough to be afraid of subtle aggregation problems that pop up when combining multiple tricks. A good hash will maintain all of the properties it needs, and there should be no need to use it as in input to another hash. I'd use SHA-512, it is NIST-approved, it has an adjustable number of rounds, the default number of rounds is 5000, and the salt is 16 bytes. It is sufficiently slow when trying to crack it. JtR gives me about 1200 keys/sec on a 4-core 3.2GHz i7.