16,590 reputation
12685
bio website
location Brooklyn, NY
age 32
visits member for 2 years, 11 months
seen 1 hour ago
Good Morning how are you, I'm dr jimbob
I'm interested in things.
I'm not a real dr,
But I am a real jim bob.

Have a PhD in Experimental High-Energy Physics, but left academia in mid-2010 to program professionally.

Mostly program/script in python, django, and jquery these days doing mostly web apps.

Also have experience programming in C, C++, java, haskell, php, and (bash) shell more in the past.

Linux as primary OS since 1999, ubuntu user since 2005 (Hoary).


Jul
26
revised How can i find what hashing algorithm was used?
deleted 187 characters in body; added 8 characters in body
Jul
26
comment How can i find what hashing algorithm was used?
Awesome answer, but I think you somewhat undercounted when saying only 26063 choices. For pw="INSECURE"; with hash=35240, your method gets 3,812,714 by my count with len(set(list(reverse_make_hash(35240,8)))). Much more consistent with my updated rough estimate of at most 9^7 (somewhere between 9^7 and 8^7). And this is a bit of an overestimate as only the first 8 decimal digits of the mult=10 hash matter, so they'll be some repeats.
Jul
26
revised How can i find what hashing algorithm was used?
added 3231 characters in body
Jul
26
comment How can i find what hashing algorithm was used?
@LucasKauffman - You assume too much--I don't even think there IS a database. This is just a script to redirect you to a "secret" 8-character page if you type the right 8-character password. Or you can just guess what that page is from looking at the hash and seeing its one of just 10^8 possible values and brute force it.
Jul
26
comment How can i find what hashing algorithm was used?
(E.g., so if your password was 'insecure' you call makehash("INSECURE", 3) and makehash("INSECURE", 10) to get the actual (unsalted) hash and recover the eight-char forwarding URL; again its a minor detail and doesn't change the fact that the best attack is still to just guess all the possible 10^8 URLs you may be redirected to).
Jul
26
comment How can i find what hashing algorithm was used?
@Lucb1e - You had a mistake in your code. It is A = 1 as javascript is zero indexed. Copy alpha and the makehash function into a javascript console, and type makehash('AAAAAAAA',3) and you get 3280. Type into a calculator: 3*(3*(3*(3*(3*(3*(3*(1)+1)+1)+1)+1)+1)+1)+1 and get 3280. Or notice "ABC".indexOf('A') gives 0. (I didn't point this out in your answer as its subtle and a small implementation detail in your otherwise great answer). I also refactored out the capitalization from the hash function for simplicity and put case-insensitive in the text.
Jul
26
awarded  Nice Answer
Jul
25
revised How can i find what hashing algorithm was used?
added 467 characters in body
Jul
25
revised How can i find what hashing algorithm was used?
added 1806 characters in body; added 267 characters in body
Jul
25
revised How can i find what hashing algorithm was used?
added 176 characters in body; edited body
Jul
25
answered How can i find what hashing algorithm was used?
Jul
23
comment How to know who I am protecting database information from?
@crawfish - In principle, there's no difference between transparent disk encryption and encrypting/decrypting all the sensitive fields yourself; its just simpler to setup and manage without accidentally introducing a vulnerability. E.g., the application/database caches the decryption key in a (temporary) table/file/memory somewhere that an admin could access or there's an attack at the way you are implementing encryption. For that reason, I'd prefer TDE to storing/pulling application encrypted data in the db. The downside of doing both is possible performance hit and cost of implementing.
Jul
23
awarded  Nice Answer
Jul
18
comment Is it worth the effort to store FTP passwords encrypted?
Choose another vendor or do it yourself. Using FTP is simply unacceptable if you care the least bit about either the confidentiality or integrity of your data. and they are not willing to use secure protocols. Unencrypted FTP was a perfectly fine choice for file transfer in the 1970/1980s and has been outdated since the late 1990s. If these morons still use unencrypted FTP server in 2012, I would not trust their ability to do anything with any competence and would expect many many other headaches from other idiotic decision-making ability.
Jul
18
comment How to know who I am protecting database information from?
In your global oil case, the threats are not strictly external. E.g., a disgruntled employees may be turned secret activist or data thief for the competition/wikileaks.
Jul
17
answered How to know who I am protecting database information from?
Jul
17
answered Is it worth the effort to store FTP passwords encrypted?
Jul
17
comment Is it worth the effort to store FTP passwords encrypted?
+1; though you can use plain old FTP with their plaintext passwords if its over a VPN tunnel. Though if its a linux setup since open-ssh comes with SFTP; why bother setting up an FTP daemon when sftp comes for free.
Jul
17
answered Is it possible to modify a CA without having to reissue all of the derived certificates?
Jul
16
comment Is it common practice to log rejected passwords?
@Drew Lex - You can (and should) log that someone has entered an incorrect password to some user's account from IP address at some time, and possibly enable extra security (require CAPTCHAs, delays between retries, block an IP address, lock an account, etc) if the failed logins are too frequent (e.g., starting at about ~5 consecutive attempts). But there's no legitimate reason to log the passwords they actually are typing.