43,457 reputation
1294172
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 6 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
7
comment Why shouldn't we roll our own?
@Ramhound I'm aware, I'm just asking the question for the sake of having a go-to answer. It'd be great if you could offer a second answer to compete with dr jimbob's.
Aug
7
answered Virus developers groups
Aug
7
revised Virus developers groups
chaff
Aug
7
comment Publicly available Botnet Traffic dataset
Just to clarify, are you looking for packet dumps to/from infected machines, packet dumps to/from C&C servers, or samples of the malware itself?
Aug
7
comment Why shouldn't we roll our own?
@AndrewSmith The comments are not for sharing of personal opinions or random chatter. They are for asking for clarification about a question. You've been warned about this before, and I've seen you do it again on several other questions. If you want to chat, please do so in the DMZ.
Aug
6
answered What are the security advantage of new redirecting method used by Gmail and Facebook?
Aug
6
comment Dangers of a vulnerability in a local installer?
Ah, ok. Still, if you're shipping to customers, 99% of this still stands.
Aug
6
comment Why shouldn't we roll our own?
For reference, D.W. posted a great starting point here.
Aug
6
revised Why shouldn't we roll our own?
xkcd
Aug
6
revised Dangers of a vulnerability in a local installer?
added 84 characters in body
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
The salt would never be typed in by a person. It's generated randomly and stored in the database with the hash.
Aug
6
revised Dangers of a vulnerability in a local installer?
gif for the lulz
Aug
6
asked Why shouldn't we roll our own?
Aug
6
answered Dangers of a vulnerability in a local installer?
Aug
6
revised How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
update
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
You're making this a lot more complicated than necessary. I suggest you read through the answer I linked (this one) and improve your understanding of password hashing and salting schemes before continuing.
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
Where are you storing it, then? I sincerely hope that the salt is unique to each user.
Aug
6
revised How to store salt?
s/hash/salt/
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
What do you mean by "the salt will remain in the hash"? If you hash the salt, you cannot retrieve the original salt, so how do you verify that a password is correct?
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
No, that's incorrect. The attacker already knows your salt, because he's breached your database to get the hash. The point of the salt is to make every hash unique, so that a precomputed database cannot be used to look up all hashes and get the plaintext. The reason you should use a large random salt is that it makes the probability of duplicates near zero.