Reputation
14,032
Top tag
Next privilege 15,000 Rep.
Protect questions
Badges
3 48 100
Impact
~1.1m people reached

Apr
6
comment Does hashing a file from an unsigned website give a false sense of security?
@Pacerier as the other answers, by security professionals, have made clear, an attacker can typically change the hashes also, and hashes are not designed to be used by themselves to sign things. Furthermore, MD5 was broken years ago. It is easy now to create two files with the same MD5 hash. SHA1 is also suspect, and does not meet modern requirements. But as noted, even switching to SHA-2 or SHA-3 by itself, even with https, would provide hardly any protection.
Apr
3
awarded  Popular Question
Feb
27
comment How are browser saved passwords vulnerable?
@Rodrigo It depends in complex ways on the combination of browser, OS, etc. See e.g. security.stackexchange.com/questions/40884/…
Feb
22
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
@LarsH you're right, most hashes lose information, and you may not be able to find the original password. But most of the time you just need a password that results in the same hash, and that is always possible, given enough resources, so long at it is a valid hash. I've updated my answer a bit.
Feb
22
revised Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
....or a password that works...
Feb
15
awarded  Popular Question
Feb
9
awarded  Notable Question
Jan
13
comment How can we accurately measure a password entropy range?
Thanks @AlexisWilke! I updated the answer.
Jan
13
revised How can we accurately measure a password entropy range?
update as noted by Alexis Wilke
Nov
23
awarded  Yearling
Sep
23
revised Should websites be allowed to disable autocomplete on forms or fields?
clarify which comment BenB made
Sep
13
awarded  Notable Question
Sep
7
accepted Examples of “Runtime application self-protection” (RASP) in action?
Sep
7
revised Examples of “Runtime application self-protection” (RASP) in action?
better link text
Sep
4
awarded  Notable Question
Jul
23
awarded  Caucus
Jul
4
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
Can you consolidate your answer to lead with the variety of ratings, which really helps inform our speculation about why they make these choices? Also, since there are 4 distinct attacks, I suppose they might come up with a rating for each.... Then I'll accept it. Thanks for the very helpful research!
Jul
4
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
Interesting also that SCIP ranks it as "high" access complexity. That may apply to the Integrity and Availability scores they give, and I suppose that for a time it might apply to the Confidentiality score. But it seems to me that the best scoring is by Polycom, IBM and Redhat: (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3
Jul
2
comment Why is logjam rated as “None” for confidentiality impact in CVSS?
@StackzOfZtuff Wow - fascinating. And IBM rates it as I:N also (no integrity impact), which may reflect an assessment that it is much harder to get MITM there, IIRC.
Jun
30
asked Why is logjam rated as “None” for confidentiality impact in CVSS?