Reputation
1,532
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 6 11
Impact
~43k people reached

Nov
17
comment If I enter a password on the wrong site, should I consider it compromised?
@iismathwizard, yes, hence the "even". You SHOULD hash them, but this answer said "logging cleartext is a vulnerability". I wanted to add "even logging encrypted is".
Nov
13
comment If I enter a password on the wrong site, should I consider it compromised?
Deduplicator: I agree. You just strenghten my argument.
Nov
13
comment If I enter a password on the wrong site, should I consider it compromised?
Surely not "as likely". When you use the same password, your password (or a hash) is sure to be saved on site1 and site2. A hacker who gets the database, can try to recover your password. With just a password attempt, chances are muich much greater the password used for the attempt itself is not logged.
Nov
13
comment If I enter a password on the wrong site, should I consider it compromised?
Why "cleartext versions"? Even if its reversible-encrypted, the malevolent site owner or hacker who can reverse, has the pass.
Apr
22
comment If a web site shows me what my password was changed to, is it stored as plain text?
It might be wiser to differentiate between "stored in a way it can be retrieved" (be it plain text or reversible encryption) and "stored in an unretrievable way" (one way hashing).
Sep
9
comment How can I tell if I have the citadel virus without downloading an antivirus?
Actually pretty commendable of Virgin Media to send you an email and host a generic version on their website to prove its authenticity. Quite nice!
Jul
31
comment Trust Issues Relative to Open Source
The Tor Project has a very interesting blog post about Deterministic Builds that explains some of the troubles with this.
Jan
24
comment Is my developer's home-brew password security right or wrong, and why?
@Casey: offcourse, always invent your own. Make your own linked list, your own crypto, your own database, your own mergesort. Implement the algorithms and datastructures to understand them better. Then throw the implementation away - the existing are almost always better. If not, get on the project and improve them! Your peers will review your changes and give feedback. If you're wrong, you'll learn, if you're right, your changes benefit all humankind ;)
Nov
26
comment Irreversible hashing without collision
Hmm I'll investigate if there is some other data we can pull off the smart card. Would taking two hashes even further reduce the chance on collissions? Calculating both, Hash1(A) and Hash2(A), so that if Hash1(A) = Hash1(B), the chance for Hash2(A) <> Hash2(B) is big enough?
Nov
26
comment Irreversible hashing without collision
What would happen if I would actually use encoding? Encode using the public key, and throw the private key away. If I re-encode the same input later with the same key, does it give the same result? Could I use encoding as hashing?
Mar
6
comment At what point does something count as 'security through obscurity'?
The obscurity indeed refers to an procedure (algorithm), rather than a piece of shared knowledge (password). Often the reason why "security through obscurity" is considered bad, is because the opposite (public, known, tried, tested, proven algorithms) is considered good. People trying to implement an "obscure" algorithm will often invent their own, often overlooking certain things and creating huge vulnerabilities.
Feb
7
comment How do I know a piece of software only does what the author claims?
Or you can ask for the ingredients and cook it yourself (download source code & compile).
Feb
22
comment Are “man in the middle” attacks extremely rare?
Funny how the OP asks for cold, hard, real world data and you start with Well I guess...
Jun
8
comment Is denying login after incorrect attempts ineffective?
Plus, the actual account owner sees that someone was trying passwords on his account. If they'd just add a "list of last 1000 dates and IP-addresses that accessed your account", it would prevent a lot of "lurkers"...