1,668 reputation
1922
bio website traveljournal.net
location Netherlands
age
visits member for 3 years, 8 months
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


Oct
15
comment Base64 encode diffences in BCrypt implemenations
thanks for the explaining
Oct
15
accepted Base64 encode diffences in BCrypt implemenations
Oct
15
accepted Mobile OTP - Secure?
Oct
15
asked Base64 encode diffences in BCrypt implemenations
Oct
12
comment Pre-hash password before applying bcrypt to avoid restricting password length
So, if I understand correctly, the increased digest length does not have any real value in this use case?
Oct
12
comment Pre-hash password before applying bcrypt to avoid restricting password length
Would the use of SHA384 improve anything over SHA256?
Oct
8
revised How does one properly assess risk?
added 24 characters in body
Oct
8
answered How does one properly assess risk?
Oct
2
comment What ciphers should I use in my web server after I configure my SSL certificate?
Thanks! I've been looking all over the internet, you're the only person to give information that allows me to make a (somewhat) informed decision, instead of just giving some non-argued recommendation.
Oct
1
revised Implementing SRP Challenge login system *with SSL* (Using PHP)
added 2 characters in body
Oct
1
answered Implementing SRP Challenge login system *with SSL* (Using PHP)
Oct
1
answered Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?
Sep
27
revised How to invalidate a session on browser closure?
added 232 characters in body
Sep
26
answered How to invalidate a session on browser closure?
Sep
24
comment Should I have a maximum password length?
hey, that's interesting? do you have a link for further reading on the BCrypt char limit?
Sep
21
comment Is there any good (or less bad) way to handle a web portal or website with awful security?
make the answers to the security question random strings, as many bytes as accepted (up to a sensible maximum).
Sep
14
comment Is this a good way to store passwords in a Web Application?
-1 using general purpose hashes are not good at all for password hasing, the salt is not random.
Sep
13
comment Where to put private files on a shared web server
There are some control panels out there (plesk, among others) that force users on a shared hosts to only read from their own webroot, instead of jailing them to their own home directory. This always bothered me.
Sep
7
comment Scrypt + Bcrypt = cascade hashing
People writing about security issues mixing up encryption and hashing always makes me a bit skeptical.
Aug
30
comment Role Based Access Control + Data Ownership based permissions
why the downvote?