171 reputation
5
bio website
location
age
visits member for 1 year, 9 months
seen yesterday

Aug
27
awarded  Commentator
Aug
27
comment Is hashing the hash considered an extra level of security
The speed of a single iteration does not matter much. The faster an attacker can calculate hashes, the faster your password server can, allowing you to proportionally increase the number of iterations required. Of course, I agree this particular implementation is naïve and should be avoided for reasons stated.
Jun
27
comment Does gmail's TOS allow Google to steal your emailed ideas?
While it is good advice not to rely on a company's terms of service for not snooping around sensitive data, this answer appears to be largely based on ideas being subject to intellectual property rights at all, which is a misconception.
Jun
26
comment Are efforts being made to bring about password standards?
@David: If a user tries to send five gigabytes of data through a password field, treating it like a valid password could consume a lot of resources or trigger unexpected behaviour of code that was not written to handle this gracefully.
Apr
9
answered How easy is it really to do IP spoofing?
Feb
23
comment Is using SHA-512 for storing passwords tolerable?
I sympathise with @SnakeDoc. Sure, there is a legitimate trade-off between cost and security, but there's also a moral (and possibly legal) obligation to protect your clients' data. I wouldn't want to do business with a company that chooses to store my password in plain text because a breach is only going to cost $100. The question asks for something far less extreme; I don't know whether SHA-512 would qualify as intolerable bad practice, but I wouldn't be too quick to recommend it either.
Aug
30
comment Is the Web browser status bar always trustable?
@bobince: Can you provide an example?
Jun
21
comment Hosting an “IP Rental” address. Is this common, safe?
By all means, advise caution, but this answer is overstating the risks sufficiently to make it almost completely wrong, if I may say so.
Apr
3
awarded  Critic
Apr
2
comment Password and Generated number - How does it work?
I read it as referencing highly authoritative sources. +1 for that.
Apr
1
answered Why improvising your own Hash function out of existing hash functions is so bad
Mar
8
awarded  Custodian
Mar
8
reviewed No Action Needed Are password complexity rules counterproductive?
Feb
6
awarded  Supporter
Jan
19
comment How to remain 100% anonymous on the internet?
@JohnU is right. Sensitive information is not obtained from IPs, but from databases containing private data. In itself, an IP address is just a number that indicates nothing worth worrying about.
Jan
17
answered Why Say IP Addresses Are Harmless?
Jan
17
awarded  Teacher
Jan
17
comment How to remain 100% anonymous on the internet?
Purely in the interest of staying anonymous, I'd say TOR is actually fairly close to perfect for this. Most of the weaknesses boil down to the user voluntarily but unintentionally revealing his identity, but then again, no security software can withstand a determined end user.
Jan
17
answered Is it possible to decode xor encoded string from N copys?