1,443 reputation
1720
bio website traveljournal.net
location Netherlands
age
visits member for 3 years
seen Jan 31 '13 at 11:06

The more I learn about security, the more I realise I don't know anything about the subject.


May
19
comment How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
@Jürgen Thelen, I have the strong feeling you are not talking about PHP's include() at all. But rather are talking about hosting images. Also, when you would use include(), moving the files to another domain will not protect you.
May
18
answered How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
May
14
comment How to securely hash passwords?
@nealmcb I've been looking at the C source code for the OpenBSD implementation, and indeed it has a salt generation algorithm build in. However, this on my debian machine, I have to supply a salt, prefixed with $2a$, to the crypt to use the BCrypt algorithm. The same is true for the PHP implementation(s). So I'm not sure any more about the article plain wrong. But there are implementations out there that do require external salting. So the article is also not correct either, at least not for always.
May
14
awarded  Commentator
May
14
awarded  Nice Question
May
14
awarded  Critic
May
14
revised Password Hashing add salt + pepper or is salt enough?
edited tags
May
12
awarded  Teacher
May
10
comment How to securely hash passwords?
@nealmcb, The OpenBSD implementation of BCrypt, as deployed as part of the operating system, has built in salts (as do some JAVA implementations). This salt salting is handled by the implementation specific wrapper/helper functions. The CodaHale.com article takes the Provos & Mazières paper (dealing with the OpenBSD implementation) out of it's context and suggests that the BCrypt hashing algorithm has build in salts. This is a false suggestion; the BCrypt hashing algorithm itself does not have build-in salts.
Apr
26
revised Surfing anynomously
added 1 characters in body
Apr
26
answered Surfing anynomously
Apr
26
suggested suggested edit on Possibility of undetectable encryption system
Apr
23
comment Password Hashing add salt + pepper or is salt enough?
Hmm, the edit removed the much of the uncertainty present in the answer as written by @Jesper Mortensen. Maybe the edit should be rolled back and moved to a separate answer?
Apr
23
revised Password Hashing add salt + pepper or is salt enough?
Removed the "PBKDF2". see also: http://security.stackexchange.com/questions/2051/is-pbkdf2-based-system-cryptology-rfc2898derivebytes-better-for-unicode-passw/2056#2056; deleted 1 characters in body
Apr
22
comment Password Hashing add salt + pepper or is salt enough?
I'm trying to wrap my brain around "Adding a key the hash transforms it into a MAC". Am I correct in understanding that, by adding a constant value (along with the password and salt) into the hashing algorithm, the changed use of the primitive affect the stength of the outcome? And that, if the key is known, the overall scheme is likely to be less secure?
Apr
22
revised Password Hashing add salt + pepper or is salt enough?
edited body
Apr
22
awarded  Student
Apr
22
revised Password Hashing add salt + pepper or is salt enough?
added 6 characters in body
Apr
22
revised Password Hashing add salt + pepper or is salt enough?
added 9 characters in body
Apr
22
comment How to securely hash passwords?
The article linked by @Rory McCune is, as far as I know, flawed in suggesting that using BCrypt makes salting unnecessary. This is not true and based on his misinterpretation of the Provos & Mazières paper linked by him.