Reputation
26,444
Next tag badge:
101/100 score
17/20 answers
Badges
5 56 120
Impact
~1.9m people reached

Jan
26
answered Why did customer services say using symbols in a password is insecure?
Jan
26
awarded  Enlightened
Jan
26
awarded  Nice Answer
Jan
21
comment Is reading from prod to dev a security concern?
Is the copied data secret or confidential in any way? If so, copying it out of a locked down environment to a looser dev environment does create the opportunity for that information to leak out (due to any temporary flaws in the dev environment).
Jan
13
comment Is it possible for my password to have more than one password combination?
@A.L - I'm going to keep using tilde for approximately. It's a common succinct notation ( en.wikipedia.org/wiki/Tilde#Common_use ) for "approximately" (as a unary operator; e.g., about ~7 billion humans) or "approximately equal" (as a binary operator e.g., 2^10 ~ 10^3) and my answers already tend to be on the long side. I'd rather just explain this notation to people unfamiliar with it if they ask.
Jan
13
comment Is it possible for my password to have more than one password combination?
@aross - It had two bad features; (1) password in plaintext/reversible encryption (forgot password features should require you to validate yourself and then set a new password), and (2) stripping out special characters from your password drastically weakens it. Take OP's pw !78ghA,NJ58*#3&* - 16 chars randomly chosen from 96 printable ASCII chars : ~105.4 bits of entropy (52040292466647269602037015248896 pws) - very secure. Stripping special chars makes it 59.5 bits (839299365868340224 pws) - much less secure. If numbers were also stripped its 28.5 bits (380,204,032 pws) - very weak.
Jan
13
awarded  Good Answer
Jan
13
revised Is it possible for my password to have more than one password combination?
deleted 7 characters in body
Jan
13
comment Is it possible for my password to have more than one password combination?
In this context, it means approximately equals; it has other meanings in other math contexts, see en.wikipedia.org/wiki/Tilde#Mathematics . The main reason for not using the slightly clearer ≃ is that unicode is harder to type. As for where it comes from 2^256 = 115792089237316195423570985008687907853269984665640564039457584007913129639936 = 1.1579... x 10^77 ~ 10^77 (I originally had off-by-one typo). If you want to find what power it is you could just set 2^256 = 10^x then take the log of both sides and use well-known properties of logs to find x = 256 log(2) / log(10) ~ 77.
Jan
12
answered How to securely counter users from adding a single digit to their old password upon creating a new one?
Jan
12
revised Is it possible for my password to have more than one password combination?
added 567 characters in body
Jan
12
answered Is it possible for my password to have more than one password combination?
Jan
8
comment Does holding an AES-encrypted string and its cleartext from a database help an attacker in decrypting other parts of the database
Not saying anything is wrong with Xander's answer, but feel like adding that this answer assuming AES (the block cipher encryption function) is being used properly then it will be CPA-secure (as far as we know). If you used AES in say ECB mode (which should never be used), then an attacker can do chosen plaintext attacks on your database by encrypting various likely plaintexts and seeing wherever it matches encrypted data. Or if you used AES in CTR mode but the same seed is used to encrypt different data, then you've lost semantic security if the attacker can do chosen-plaintext attacks.
Jan
5
awarded  Good Question
Jan
4
awarded  Famous Question
Jan
2
comment GET Security over HTTPS
As well as Is there a difference between GET and POST for web application security? and probably several other questions.
Jan
2
comment Are zip codes considered to be personal identifying information?
@JanDoggen Really it depends on the legal authority and the specific use. It's probably safest to assume for personal use that it is PII and to appropriately deidentify as HHS suggests, but in most cases the five-digit zip alone will not be able to uniquely identify individuals.
Jan
2
comment Are zip codes considered to be personal identifying information?
I didn't directly answer it, because like many questions its not a simple yes/no. If your health care provider mails you a letter and your zip code is showing on the outside of an envelope to your mail carrier, is that a privacy breach? Obviously it would be if they printed your SSN, date of birth, credit card number on the envelope it would be. Or if only one family resides in a zip code and you are listed as a customer your privacy was violated (though this rare case happens for about 0.00001% of Americans), so it would break HIPAA to publicly state someone from 30334 had illness X.
Jan
1
awarded  Good Answer
Jan
1
comment Avoid unauthorized updating of online leaderboard php/sql
If a player submits a series of moves to your server that would produce a high score, your server checks that those moves give the player an appropriate high score even when the game was entirely played offline. Granted this doesn't validate that a human actually found those moves to play on an actual device (versus wrote an AI program to play the game well), but you'll never be able to verify it was done by humans without actually having trustworthy judges watch the human play the game. (And you can add in randomization by treating the seed to your RNG as part of the solution).