621 reputation
14
bio website
location
age
visits member for 1 year, 2 months
seen Apr 13 at 21:43

Mar
26
answered True?: “Nearly all encrypted passwords are stored with the last character in clear text”?
Mar
22
answered Why use PBKDF2 over multiple iterations of a another cryptographic hash function?
Mar
17
awarded  Nice Answer
Jan
29
awarded  Yearling
Dec
9
answered At what length does a password stop making sense?
Nov
9
answered How safe are password managers like LastPass?
Nov
1
comment How secure is WD MyPassport lock
Unless WD publish the details or someone goes through a lot of trouble to reverse engineer this we simply won't know how good it is. As @tom-leek there are a lot of subtle things that need to be done right. It's easy for experts to screw up. And just because WD is a big company, that doesn't mean they have the expertise (in the right place).
Oct
20
answered How does a key file increase the security of a password manager?
Oct
12
comment Is it possible to brute force all 8 character passwords in an offline attack?
One thing to keep in mind is that NTLMv1 passwords are particularly easy and so should not be extrapolated from. Because of how NTLM hashes passwords a 16 character password is takes only twice the amount of time to crack as an 8 character one.
Sep
26
answered has scrypt withstood the test of time?
Sep
26
comment has scrypt withstood the test of time?
Everyone paying close attention to the Password Hashing Competition expects that Colin Percival will be submitting a revision of scrypt.
Sep
24
comment What are the features of Dual EC DRBG that are lost when using a different cipher?
I don't think Sam Curry is stupid. His stupid "explanation" may be the consequence of being compelled to justify the unjustifiable.
Sep
24
answered What are the features of Dual EC DRBG that are lost when using a different cipher?
Sep
12
comment How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?
Using HMAC-SHA512 may actually be a reasonable choice as it hurts the attacker more than the defender. (GPU-based crackers don't do SHA512.)
Sep
12
answered How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?
Sep
11
answered How to generete dictionary for brute force attack?
Sep
4
awarded  Editor
Sep
4
revised Do salts have to be random, or just unique and unknown?
Changed emphasis to reflect edited question.
Sep
4
answered Is it possible to find who posted comment on my blogspot anonymously?
Sep
4
answered How many bytes should an authorization token have?