Reputation
63,374
Next tag badge:
1520/400 score
75/80 answers
Badges
17 155 253
Impact
~2.8m people reached

Feb
5
answered Attack Vectors for Purely Static Website (HTML and CSS)
Feb
5
comment Determine hashing algorithm only with known input and output
@almathie That isn't true. When the salt is secret and static, it is no longer a salt; it is the key for a MAC.
Feb
5
accepted Fixing the high-bit problem in PHP's crypt() implementation
Feb
5
comment Fixing the high-bit problem in PHP's crypt() implementation
Done. Final implementation loops through all chars (single-byte) and checks that they're 0x7F or lower, and rejects any string that violates this.
Feb
5
comment Fixing the high-bit problem in PHP's crypt() implementation
Good idea. I'll make sure to do that.
Feb
5
comment Fixing the high-bit problem in PHP's crypt() implementation
Any suggestions for better mitigations?
Feb
5
comment Determine hashing algorithm only with known input and output
Scratch that - on second thoughts your question is quite interesting. Since you have the ability to ask the system to hash any arbitrary message, it may be possible to recover the mechanism. I don't see it being trivial though. Depends how much more information we have.
Feb
5
reviewed Approve Determine hashing algorithm only with known input and output
Feb
5
comment Determine hashing algorithm only with known input and output
Where did this hash come from? It doesn't look like a pure cryptographic hash - too many 00 pairs. Without knowing more, this is impossible. Besides, we don't tend to accept questions like this on StackExchange - we have guidelines about question quality and this would fall under "too localised" and "not a real question" - see the FAQ for details.
Feb
5
comment Firefox pre-downloading
Could someone link to any official documentation on this feature? It'd be very useful to see how / why this is done.
Feb
5
asked Fixing the high-bit problem in PHP's crypt() implementation
Feb
5
revised Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
mistake
Feb
5
comment Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
Whoops, my bad!
Feb
5
answered Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
Feb
4
comment Picking an encryption algorithm for auth tokens passed via AJAX
What's wrong with standard block ciphers like AES? On modern CPUs the overhead is minuscule.
Feb
4
reviewed Edit Securing the SOAP Messages
Feb
4
revised Securing the SOAP Messages
improved formatting / grammar
Feb
3
comment Maltego transform samples
Didn't know you had an account on here Nadeem! Cheers for this. Still interested in more details on how various data types are used in raw transforms though.
Feb
3
answered my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it
Feb
3
comment Encrypting user data using password and forgot my password
@CodesInChaos Sure, that works too. It's not really any different in terms of security, just more efficient.