426 reputation
48
bio website
location Georgia
age 32
visits member for 3 years, 3 months
seen Nov 8 at 13:33

Sep
22
comment How do I hash a password in C#?
There are really only two correct ways to implement password hashing. Trying to suggest anything else, I would go as far as saying, doing so would be unethical.
Sep
22
comment How do I hash a password in C#?
This sounds not standard, bcrypt is easy enough to implement just do it 100,000 times and every year increase it by 50,000 and generate the password hashes again
Sep
13
comment Does company email can access hangouts and private emails?
@CaryBondoc - An Administrator more then likely can access your Google account associated to your company for a variety of reasons.
Apr
30
comment Can website see my payment information?
@user1880405 - Have you ever purchased something online before using a credit card?
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
@week - I am not 100% sure if there is a secret token in the authenticator implementation Google uses.. I know how the physical and digital Vasco authenticators work. There is a known serial, known server time, and a secret token.
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
@Raystafarian - The standard behind the Microsoft Authenticator and Google Authenticator is the same which is the reason you can use the Google Authenticator with Microsoft's online services. The point of that statement is there isn't any "secret" sauce in these authenticators except the source data ( i.e. serial of the authenticator ). This is the reason I say that that grid is more secure because if you supply a third-party with this serial they (might) have the required information to replicate your authenticator on any device they want. I believe there is a third peice..
Apr
29
comment LastPass Grid Authentication vs Google Authenticator which one is more secure?
The grid is noise generated. The google authenticator is based on 3 different values cand if you know all 3 you can generated ANY code at any point in time. By this very fact the grid is more secure. The phone being lost isn't a concern because the authenticator can be restored to any device.
Apr
26
comment AES Key Generation?
If thats the only source of random entropy then, of course it would generate the same key.
Apr
11
comment Why does TLS need an explicit heartbeat protocol?
@Lukas - It wasn't detected because the bug wasn't in every version of OpenSSL.
Apr
11
comment Using client certificates for website authentication
There might be. What has your research shown?
Apr
11
comment How can I confirm that my server is protected against HeartBleed?
@gowenfawr - I can't even tell what version that advisory effects and what version fixes the reported problem. I consider myself to be a smart individual, didn't realize RHS backpatched it granted, but holly cow that advisory is complete non-sense.
Apr
11
comment Should I cancel my current credit card because of heartbleed vulnerability?
I would say it depends. Most credit card companies won't hold you responsible for something like this. Your credit card would have only been compromise when you submitted the form, in most cases, what actually is stored is just an authorization token. Granted ALL traffic from the compromised certificate could be decrypted, the amount of data your talking about, would be enormous.
Apr
11
comment Why does TLS need an explicit heartbeat protocol?
Please dive deeper into the reason its useless because its not useless otherwise hundreds of thousands of very smart people wouldn't have enabled it and it wouldn't have even been developed.
Apr
11
comment Why can't we create a new SSL implementation?
The main reason? The current SSL specification standard isn't flawed. How its implemented in specific cases is flawed. There is a difference. Besides if people used Perfect Forward Secrecy this wouldn't be a problem. The big guys actually already do, except Yahoo, but Yahoo also transited everything within their network in plain text until a few months ago.
Apr
11
comment How can I confirm that my server is protected against HeartBleed?
If you have 1.0.1e installed and versions up to 1.0.1f are vulnerable then your version is currently vulnerable. If you even THINK you are vulnerable you should update OpenSSL and revoke your certificate. You can also disable the SSL/TSL Heartbeat feature as an additional security measure
Mar
8
comment Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form?
Why would you want an a blob of encrypted data?
Mar
4
comment Are virtual keyboards themselves secure?
Why don't you just use the virtual keyboard built into Windows?
Jan
29
comment Does two-factor authentication reduce the need for a long password?
What does your security on your google account have to do with the security on another website have to do with one another? Long passwords are to avoid the brute force attack
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
@FranciscoPresencia - If either salt was known they would be able to brute force the user's password because all you did was hash it twice with two separate salts. The simplest of the passwords will be brute forced.
Jan
11
comment PC showed evidence of a phone being attached for no obvious reason. Theories on why?
I don't understand the question. This simply sounds like a phone was connected to the computer.