Jacco

1,292 reputation

1614

bio	website	traveljournal.net
	location	Netherlands
	age
visits	member for	2 years, 1 month
	seen	Jan 31 at 11:06
stats	profile views	106

The more I learn about security, the more I realise I don't know anything about the subject.

	1,292 reputation	bio	website	traveljournal.net	visits	member for	2 years, 1 month
1614 badges		location	Netherlands		seen	Jan 31 at 11:06

summary answers questions tags badges favorites bounties reputation activity

161 Actions

suggestions reviews revisions comments badges posts accepts all

Jul 10	comment	Comparing the standard HTML form POST for user authentication vs Javascript/AJAX Would an anti CSRF token, as mentnioned by AndreyBotalov, change anything?
Jul 10	revised	Comparing the standard HTML form POST for user authentication vs Javascript/AJAX added 6 characters in body
Jul 10	comment	NoScript: How to determine which sites/scripts to whitelist? With all respect, but I was shocked by this service. Under "privacy", it claims: "When you visit a website without Light Point Web, that website’s owner can learn information about you" yes, so instead you propose to disclose everything to your service! This is beyond facebook evil.
Jul 10	revised	Comparing the standard HTML form POST for user authentication vs Javascript/AJAX added 9 characters in body
Jul 10	asked	Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Jul 9	comment	Is the password hash better when you concatenate the password and username? email and username are NOT good salt values. They fail at being unique across systems. The salt should be unique and non-predicatbale. This is meant worldwide. Best practice: use a random set of bytes with an unpredictable random generator, preferably within a salt space large enough to make collisions improbable. It is tempting to try to derive a salt from some data which is "presumably unique", but such schemes often fail due to some overlooked details. Since it is comparatively easy to creating sufficiently random salt value, stick to the best practice.
Jul 5	comment	Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password? @user917279, I just wanted to link to the other question, with the questionmark I tried to indicate they might not be identical duplicates
Jul 4	comment	Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password? duplicate: security.stackexchange.com/questions/3165/… ?
Jul 4	comment	Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password? +1 for the good writeup. The thing that is often cited is that, if the password hashes are stolen by a limited read only vulnerability (for example SQL-injection), the attacker has, due to the absence of a secret-key, all the variables needed for an offline attack. There has been some discussion about adding both a pepper and a salt. The accepted answer there advices against HMAC and recommends BCrypt.
Jul 2	comment	Are passwords made up from concatenating a few foreign words better than shorter random characters? duplicate: security.stackexchange.com/questions/6095/…
Jul 2	comment	How to refute “don't use internet if you don't like it” answer? "is privacy a basic human right"? according to the The Universal Declaration of Human Rights and also according to European Convention on Human Rights, it is.
Jul 2	comment	Recompute Rainbow table with salt? maybe also read: http://stackoverflow.com/questions/1645161/salt-generation-and-open-source-soft‌ware/1645190
Jun 28	answered	How to defend against invalid UTF7/8 that hides a <script> tag?
Jun 12	comment	Why would salt not have prevented LinkedIn passwords from getting cracked? If you generate the salt from some user related data, you allow the attacker to attack multiple instances of the hash (for example on separate systems) for the cost of 1 attack. If you rely on your source code to stay secret, you enter the realms of security through obscurity.
Jun 12	comment	Why would salt not have prevented LinkedIn passwords from getting cracked? Also note that the auto-salt feature of BCrypt is not true for all implementations; most notably, the PHP implementation requires a salt value as one of the input parameters.
May 18	comment	What is the difference between RBAC and DAC/ACL? @AviD, I supect we are talking about the same thing, SoD is definately part of (the more complex) RBAC models (including NIST standard). But, to my knownledge, SoD is implemented as a constriant "Conflicting permissions cannot be included in the same role, etc" instead of negative permissions "Allow ALL + Deny DELETE" type permissions sets. (Although some RBAC implementations do also include the latter)
May 18	comment	What is the difference between RBAC and DAC/ACL? It might also be nice to note that in RBAC there are no negative-permission (deny). Although some implementations do provide them, negative permissions are usually associated with ACL/DAC and not with RBAC.
May 18	comment	What is the difference between RBAC and DAC/ACL? It might be nice to note that RBAC and ACL can replace eachother; you can configure RBAC permissions to cover the policy set out by ACL and vice versa. Also, there are quite some implementations of RBAC out there who grant discretionary powers to users. Those RBAC systems have been proven to be able to offer all functionality of DAC.
May 18	revised	Role Based Access Control + Data Ownership based permissions added summary of answer
May 18	accepted	Role Based Access Control + Data Ownership based permissions