169 reputation
7
bio website davidmurdoch.com
location Florida
age 29
visits member for 3 years, 5 months
seen Nov 19 at 13:16

I like to make things on the Internet.

You can find me:


Jun
17
comment Doesn't plaintextoffenders.com just provide attackers with a good list of sites to attack for passwords?
I thought that was one of the main reasons the site existed.
Mar
7
awarded  Teacher
Mar
6
answered Credit card number entropy?
Sep
11
awarded  Critic
Apr
9
awarded  Scholar
Apr
9
comment Is it possible to “protect” against MITM attacks over HTTP?
Voted yours as correct instead of Thomas' because he's already got 65k+ more rep than you. Both answers are equally helpful.
Apr
9
accepted Is it possible to “protect” against MITM attacks over HTTP?
Apr
9
comment Is it possible to “protect” against MITM attacks over HTTP?
"It's also worth noting that Moot isn't doing anything wrong, just the website you were visiting is embedding the login in an insecure manner." Normaly this would be true, except the website in this case is their website; the one used to register for their product (both the forum and comment system). They link to it directly from their home page.
Apr
9
awarded  Student
Apr
9
asked Is it possible to “protect” against MITM attacks over HTTP?
Oct
22
comment Why do we lock our computers?
I used to prank my co-workers whenever they didn't lock their machines: my favorite was replacing their desktop with a screenshot of their desktop and then hiding the icons; I got that process down to 25 seconds flat. :-p
Aug
3
comment Is .bank owned by banking industry or not?
I believe it may be possible for a tld administrative community to (try to) enforce certain restrictions and compliance. One thing I would love to see is banks (and other financial institutions) being required to use bcrypt/scrypt/PBKDF2/etc to hash passwords (uniquely-salted) before storing as well as a few other basic web-security measures (like allowing special characters in passwords, I'm looking at you, CitiBank).
Jul
19
comment Can anyone provide references for implementing web application self password reset mechanisms properly?
Just how many characters should the random part be?
Jul
19
comment Can anyone provide references for implementing web application self password reset mechanisms properly?
Challenge questions are the opposite of security.
Sep
12
awarded  Citizen Patrol
Aug
11
comment XKCD #936: Short complex password, or long dictionary passphrase?
footballer? As in, someone who plays football?
Jul
25
awarded  Supporter
Jun
22
awarded  Autobiographer