Reputation
596
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
5 14
Newest
 Commentator
Impact
~13k people reached

Aug
28
awarded  Commentator
Aug
28
comment Is it safe to use the SHA1 checksum of a password as a key for SHA-1?
@DavidZech social engineering, bribes or insider attack.
Aug
27
comment Is it safe to use the SHA1 checksum of a password as a key for SHA-1?
@LuisSieira chocolate bar, heartbleed, malware infection
Aug
27
comment Is it safe to use the SHA1 checksum of a password as a key for SHA-1?
I can think of an attack when Billy gets a key from the server and a database dump. That's enough to render such defence useless. A better way would be to design a system where a server has no ability to decrypt data - only user.
Jul
21
awarded  Caucus
Jul
19
awarded  Critic
Mar
6
awarded  Notable Question
Dec
15
answered Is sending plaintext passwords to a SQL Server database a security risk?
Jul
2
awarded  Curious
Jun
25
awarded  Good Question
May
6
revised Signature-based antiviruses
deleted 1 character in body
May
6
answered Signature-based antiviruses
Mar
17
awarded  Popular Question
Nov
12
comment Is it useful to protect hashed password with encryption?
"weak passwords though can be retrieved more or less fast with a dictionary attack " this statement is incorrect. It is wrong because OP says "I am hashing the users' passwords with a random, long enough, salt". Given salt is used dictionary attack becomes useless for a database. See stackoverflow.com/q/3566504/706456 for details.
Aug
26
accepted How to detect social engineering attack?
Aug
23
awarded  Yearling
Aug
23
asked How to detect social engineering attack?
Aug
2
accepted Why would one increment card security code for a new payment card
Aug
1
asked Why would one increment card security code for a new payment card
May
29
awarded  Popular Question