56,748 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 8 months
seen 2 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Feb
3
comment Encrypting user data using password and forgot my password
@CodesInChaos Sure, that works too. It's not really any different in terms of security, just more efficient.
Feb
3
comment Encrypting user data using password and forgot my password
@CodesInChaos Which is why I said "The secret answers option is the easiest, but it's possible to do this with any secret value". Also, secret questions should not be easily attainable public information - they should be things like your first high-school crush's name, or the name of your first stuffed toy as a kid. In reality such things are very difficult to guess or discover. Plus you should always provide soft-security techniques such as requiring a reset email to go to the user with the reset link, before any questions are asked.
Feb
3
comment Encrypting user data using password and forgot my password
There's no reason to use a full encryption method if you're generating two keys of equal length. The xor operation is ideal for the situation - it's essentially a one time pad with a key generated by a KDF, so you can guarantee that the security of that operation is at least as strong as the KDF and therefore at least as strong the password. You're somewhat right about running the expensive KDF twice - you could run a cheap KDF for the second option, but then you're running into a situation where offline cracking from a database dump is relatively easy. I prefer the full KDF.
Feb
3
comment Encrypting user data using password and forgot my password
Sure it does, but isn't that the standard mechanism for most things? You need to know your password, and if you don't know that you need to know your secret answers. The difference is that the latter should always be memorable. If they forget the name of their first schoolteacher and their first pet's name, that's just too bad. Security comes at the price of some usability.
Feb
3
awarded  Custodian
Feb
3
reviewed Needs Improvement Are man-in-the-middle attacks against p2p systems realistic?
Feb
3
reviewed Excellent Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)
Feb
3
reviewed Needs Improvement Do any DNS registrars support multi factor authentication?
Feb
3
reviewed Satisfactory Is it useful to determine the name of the server software while doing a penetration test?
Feb
3
reviewed Excellent How much should I care about the iOS/Android version when pentesting mobile app?
Feb
3
reviewed Excellent Is it preferable to perform encryption using database functions or code?
Feb
3
reviewed Excellent How secure is Windows 8 email authentication?
Feb
3
reviewed Excellent What does a HTML filter need to do, to protect against SVG attacks?
Feb
3
reviewed Satisfactory Is it possible to boot into root's /bin/bash on a LUKS encrypted device?
Feb
3
reviewed Satisfactory Future proof encryption possible in theory?
Feb
3
answered Encrypting user data using password and forgot my password
Feb
2
asked Maltego transform samples
Feb
2
awarded  Popular Question
Feb
1
reviewed Approve Reverse engineering malware/viruses
Feb
1
accepted What goes into an average incident response process for a corporate network?