185 reputation
7
bio website adventure-inn.com
location Costa Rica
age
visits member for 3 years
seen Jul 8 at 18:43

Apr
29
comment Can IP address be a component of 2-factor authentication?
The last line should be "and something you know (the passphrase's key)."
Mar
25
comment How does Amazon bill me without the CVC / CVV / CVV2?
@deed02392 After researching it a bit, I found this site which says "big players in the U.S. consumer-sales industry have developed informal agreements with credit-card issuers that allow charges to be made to consumers' credit cards without specifying the expiry month and year". So it looks like the big guys get to do whatever they want while small merchants (like us) don't have these special agreements. So what I said above is not entirely true.
Dec
21
comment How does Amazon bill me without the CVC / CVV / CVV2?
You certainly DO need the expiration date to charge any card. We charge cards manually all the time, but this is impossible without the expiration date. I would assume it's used as sort of a "control" since card numbers can easily be generated by trying numbers and feeding them into the Luhn algorithm. However the expiration date cannot be validated programatically.
May
16
awarded  Popular Question
Feb
12
comment Regulations that specify password length?
@Rook Good point. However hashing a 15 character password or a 1000 char password isn't going to really make a big difference. But I guess there should be SOME limit enforced, just nothing even close to being in the range of what 99.99% of normal users would provide.
Feb
12
comment Regulations that specify password length?
@Iszi Easy. When changing passwords, prompt the user for their previous one.
Feb
12
comment Regulations that specify password length?
How on earth does a maximum password length improve security under any circumstances? Just yesterday I was changing my live.com password and they give you all this stuff about security being so important to them blah blah blah, but then they cap password lengths at 15 characters.
Jul
4
revised Do most browsers handle mixed encrypted and unencrypted content correctly?
added 363 characters in body
Jul
4
accepted Do most browsers handle mixed encrypted and unencrypted content correctly?
Jul
4
comment Do most browsers handle mixed encrypted and unencrypted content correctly?
And as for security depending on "what's going through", when it comes to application development, ALWAYS assume the worst and prepare for it. If an HTTPS page can have absolutely nothing of interest, great. But it can also contain your bank account information, social security number, credit card number, PayPal account info, etc. My question wasn't "is it always a bad idea", but more along the lines of "could it ever be a bad idea in any circumstances, no matter how obscure". If the answer to the second is "yes", then browser developers should prevent this from happening.
Jul
4
comment Do most browsers handle mixed encrypted and unencrypted content correctly?
I'm not sure I agree about you of the Chrome notification being barely present. First, because it is pretty plainly visible at the top of the page. Unless your page had a very similar colored background, not many users would miss it. Second, because it doesn't matter. Why? Because the browser doesn't load any HTTP content until specifically allowed by the user. I also, personally don't see any usability loss in doing it the Chrome way.
Jun
30
asked Do most browsers handle mixed encrypted and unencrypted content correctly?
Jul
22
comment Storing sensitive information securely
Also, thank you for your help. I greatly appreciate it.
Jul
22
accepted Storing sensitive information securely
Jul
22
awarded  Scholar
Jul
22
awarded  Commentator
Jul
22
comment Storing sensitive information securely
I think I am just going to accept this answer. I think that I have basically learned that there is basically no cookie-cutter correct way to do things. I will continue to investigate any potential vulnerabilities whenever I can and try to get them patched right away. As I mentioned earlier, I think it is a good idea to use the user's password as a third part of the key. I know you talk against this here, but it won't be the entire key so I would assume it's ok.
Jul
22
comment Storing sensitive information securely
I would like to use the PCI-DSS as at least as a minimum. As I have it, your point #1 is true, which is why I would apply the limits to the decryption server. Then if someone tried to convert the whole database it would at least take a very long time. I thought about also using the user's password as a third part of key2 (i.e. key2c). This would also prevent #1 completely unless the hacker also has an active account too. I'm not sure I get point #2. As for point #3, the hacker would only obtain the key, but not the ability to use it. I could also save the key on a USB drive in a locked safe.
Jul
22
awarded  Nice Question
Jul
21
comment Storing sensitive information securely
Can you maybe give me some sort of example of a threat model for someone trying to protect, for example, social security numbers or credit card numbers? I'm sure this would apply to me as well.