Reputation
1,078
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
8 11
Newest
 Constituent
Impact
~52k people reached

Jul
24
awarded  Constituent
Jul
22
awarded  Caucus
Jul
16
comment Is this idea for a password manager secure? If so, why doesn't anybody use it?
Agreed, but an additional detail — some password managers like this allow you to set (and force you to remember) a counter of some sort, so you can generate a new password for an existing service by incrementing a number.
Jun
23
answered Work using net nanny
Jun
23
comment Work using net nanny
@JennyD — when "at work" (in this context), it's extremely likely anything on that computer could be monitored, SSL or not.
Feb
2
comment Risk of keeping OAuth2 client_secret in application
On the desktop, your application can also register to handle specific url schemes. As an alternative, you can use an in-app browser, so you don't have to open (for example) Google Chrome for the user to log in.
Feb
2
comment Risk of keeping OAuth2 client_secret in application
Depending on the API you're using, you can probably use a non-http url (for example, myapp://oauth-response), and capture that in your application
Feb
2
answered Risk of keeping OAuth2 client_secret in application
Jan
14
comment Double step verification system for homepage
Google Authenticator uses that very same Time-based OTP algorithm. So if you implement that, you can have your users log in using the same app (or another one that uses the same standard — most do)
Jan
14
answered Double step verification system for homepage
Jan
14
awarded  Good Answer
Dec
29
comment Email account password change via email-to-script
Exactly — regardless of any technical details, the worst part is telling your users to "email their password" — this should never ever be done, no matter the specifics of this scenario.
Dec
29
comment Email account password change via email-to-script
Sidenote: even if your script deletes the sent email, it might still persist in the user's email app. Additionally, it's a Bad Idea to teach your users it's ok to email passwords anywhere.
Dec
23
comment Which PHP encryption method is most incidentally-secure?
A "hash" and "encryption" are not the same thing, you need to make your question much more specific if you want helpful answers. That is — what exactly do you want to accomplish with "encryption"?
Dec
1
comment Does password-hashing “busy-work” need to be cryptographically secure
Yes, but there's also this general logic: "the simpler the system, the more secure it is". Because not having code means that you can't have bugs in that code (if it doesn't exist). If you re-wrap "secure stuff" in "insecure stuff", it doesn't generally reduce the security of the secure part, but it's even better to not have the insecure stuff in the first place.
Dec
1
answered Does password-hashing “busy-work” need to be cryptographically secure
Nov
30
awarded  Necromancer
Nov
19
awarded  Yearling
Sep
24
awarded  Autobiographer
Jul
31
comment User Account Guessing
@ArtjomB — in this scenario the point is that the attacker would not know if the email address he tried was previously used for an account. He'd simply get the "Please check your inbox to proceed creating your account" message. And if the user himself accidentally tried to create an account, they'd get an email saying "Welcome back, you already had an account".