1,448 reputation
1820
bio website traveljournal.net
location Netherlands
age
visits member for 3 years
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


Aug
30
revised Role Based Access Control + Data Ownership based permissions
deleted 1 characters in body
Aug
28
comment Avast says I don't need to use encrypted connections for my e-mail accounts
true, having the credentials makes things easier and can result in harder to prove forgery.
Aug
28
comment What can a hacker do when he has physical access to a system?
With physical access, even hardware hacks could be placed, although this is outside the scope of the question.
Aug
28
comment Avast says I don't need to use encrypted connections for my e-mail accounts
Impersonating someone with email is reasonably trivial; no need to have the authentication details.
Aug
21
comment Security Review - password_hash implementation for PHP
1) I agree the salt-value argument could be usefull for other alogithms, but for BCrypt, I think it is a bad idea. 2) I'm not familiar enough with UUID/GUID to be able to comment on the implications, but from the wikipedia info it looks like it could be usefull. 3) if the full random string is automatically serialized correctly, then this should be noted explicitly in the argument description. (maybe it is there, but I didn't see it)
Aug
21
answered Security Review - password_hash implementation for PHP
Aug
20
comment Does having a minimum number of digits improve password security?
We've had a lengthy discussion on the topic of writing down your password on a piece of paper an sticking it to the back of the keyboard. In many cases, the physical security of office rooms is a lot better than the digital security. So it can be argued that it is more secure to have a high-entropy password on the back of your keyboard, than have a low-entropy edition in the human brain. Additionally, experimenting with it showed that the human brain is perfectly capable of remembering a 16 character random password, within one to two weeks. After that, they could do without the crib sheet.
Aug
20
revised How to store salt?
typo in my name
Aug
20
suggested suggested edit on How to store salt?
Jul
30
awarded  Good Answer
Jul
21
comment How to store salt?
+1, Amen. I whish we where able to create an index/directory that points to the good answers to common/popular questions such this one. Even more so, because the common/popular questions regulary also attract quite insecure answers.
Jul
21
comment How to store salt?
Nice article! As far as I know, PBKDF2 is an Adaptive Key Derivation Function, but BCrypt and SCrypt are not; they are adaptive cost hashing algorithms. (The difference is subtle, but real).
Jul
21
comment How to store salt?
-1 'a 256bit hash' does not buy you anything of weight here. The algorithm needt to be slow. Separating the hash and salt acros different boxes, creates a whole new range of issues, just stick with the best practice instead.
Jul
20
awarded  Mortarboard
Jul
20
awarded  Nice Answer
Jul
20
answered How to store salt?
Jul
19
comment Best security algorith for storing passwords
@Rook, could you write an answer to the linked question, right now there is no good answer on this view.
Jul
19
comment Best security algorith for storing passwords
@Rook, I was wondering what your take is on adding a 'pepper' value in addition to a salt for password hashing (independent of algorithm choice). Mainly because you approach the subject from the real-life point of view, rather than the academical side.
Jul
17
comment PHP crypt() or phpass for storing passwords?
-1 "(...) to it 'sha512' or something." password hashing is a lot more complicated than just saying 'no' to 1 hash function and loosely hinting that some other hashing algorithm could be better, without any further argumentation. PHPass is widely reviewed and found to be (one of) the best libraries available for PHP.
Jul
17
awarded  Citizen Patrol