1,108 reputation
bio website
location Belgium
age 30
visits member for 3 years, 1 month
seen 22 hours ago

Functional analyst, working in Belgium. Happy to help, happy to learn.

29/04/2011: Yearling badge! I visited this site 353/365 days, but never 100 days in a row ;)

If I edited your post and didn't state why, feel free to ask. But it's probably these:

  • Fixed the title to better reflect the contents
  • Fixed spelling, punctuation and capitalisation
  • Removed "Hi, Thanks, Bye" and other non-contents fluffy filler.

comment Is my developer's home-brew password security right or wrong, and why?
@Casey: offcourse, always invent your own. Make your own linked list, your own crypto, your own database, your own mergesort. Implement the algorithms and datastructures to understand them better. Then throw the implementation away - the existing are almost always better. If not, get on the project and improve them! Your peers will review your changes and give feedback. If you're wrong, you'll learn, if you're right, your changes benefit all humankind ;)
comment Irreversible hashing without collision
Hmm I'll investigate if there is some other data we can pull off the smart card. Would taking two hashes even further reduce the chance on collissions? Calculating both, Hash1(A) and Hash2(A), so that if Hash1(A) = Hash1(B), the chance for Hash2(A) <> Hash2(B) is big enough?
comment Irreversible hashing without collision
What would happen if I would actually use encoding? Encode using the public key, and throw the private key away. If I re-encode the same input later with the same key, does it give the same result? Could I use encoding as hashing?
comment At what point does something count as 'security through obscurity'?
The obscurity indeed refers to an procedure (algorithm), rather than a piece of shared knowledge (password). Often the reason why "security through obscurity" is considered bad, is because the opposite (public, known, tried, tested, proven algorithms) is considered good. People trying to implement an "obscure" algorithm will often invent their own, often overlooking certain things and creating huge vulnerabilities.
comment How do I know a piece of software only does what the author claims?
Or you can ask for the ingredients and cook it yourself (download source code & compile).
comment Is my developer's home-brew password security right or wrong, and why?
Did you put one ^H too much or did you really mean Dave's Home-brewkinda stupid algorithm?
comment Are “man in the middle” attacks extremely rare?
Funny how the OP asks for cold, hard, real world data and you start with Well I guess...
comment Is denying login after incorrect attempts ineffective?
Plus, the actual account owner sees that someone was trying passwords on his account. If they'd just add a "list of last 1000 dates and IP-addresses that accessed your account", it would prevent a lot of "lurkers"...