1,448 reputation
1820
bio website traveljournal.net
location Netherlands
age
visits member for 3 years
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


Oct
15
asked Base64 encode diffences in BCrypt implemenations
Oct
12
comment Pre-hash password before applying bcrypt to avoid restricting password length
So, if I understand correctly, the increased digest length does not have any real value in this use case?
Oct
12
comment Pre-hash password before applying bcrypt to avoid restricting password length
Would the use of SHA384 improve anything over SHA256?
Oct
8
revised How does one properly assess risk?
added 24 characters in body
Oct
8
answered How does one properly assess risk?
Oct
2
comment What ciphers should I use in my web server after I configure my SSL certificate?
Thanks! I've been looking all over the internet, you're the only person to give information that allows me to make a (somewhat) informed decision, instead of just giving some non-argued recommendation.
Oct
1
revised Implementing SRP Challenge login system *with SSL* (Using PHP)
added 2 characters in body
Oct
1
answered Implementing SRP Challenge login system *with SSL* (Using PHP)
Oct
1
answered Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?
Sep
27
revised How to invalidate a session on browser closure?
added 232 characters in body
Sep
26
answered How to invalidate a session on browser closure?
Sep
24
comment Should I have a maximum password length?
hey, that's interesting? do you have a link for further reading on the BCrypt char limit?
Sep
21
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
make the answers to the security question random strings, as many bytes as accepted (up to a sensible maximum).
Sep
14
comment Is this a good way to store passwords in a Web Application?
-1 using general purpose hashes are not good at all for password hasing, the salt is not random.
Sep
13
comment Where to put private files on a shared web server
There are some control panels out there (plesk, among others) that force users on a shared hosts to only read from their own webroot, instead of jailing them to their own home directory. This always bothered me.
Sep
7
comment Scrypt + Bcrypt = cascade hashing
People writing about security issues mixing up encryption and hashing always makes me a bit skeptical.
Aug
30
comment Role Based Access Control + Data Ownership based permissions
why the downvote?
Aug
30
awarded  Excavator
Aug
30
revised RBAC model: user in two roles access dilemma
restored formatting on ascii drawing
Aug
30
suggested suggested edit on RBAC model: user in two roles access dilemma