101 reputation
bio website
location Netherlands
age 25
visits member for 2 years, 10 months
seen Feb 7 at 15:08

May
8
comment Is salting a hash really as secure as common knowledge implies?
@Iszi: Considering that it is extremely unlikely to ever generate the same random salt twice, and that if there is a salt collision you can just generate a new one for marginal cost, I don't think that's a very useful suggestion.
Sep
24
comment Why do some sites prevent users from reusing their old passwords?
For systems like this, I now use a password plus a suffix that indicates the year or month (depending on how often the password needs to change). I use meaningless passwords of random letters, numbers and symbols. I refuse to remember a completely new one of those every 3 months, especially when I already have several of these for different services. Like you I'm not sure what administrators are thinking they will achieve with policies with this. I think it's more likely to be counterproductive
Sep
24
comment Why do some sites prevent users from reusing their old passwords?
@Kao all you would need to do is keep a list of the hashes of passwords and verify that the hash of a changed password does not already occur in the list. If you use a proper hashing function, with salts, the usual, the list is worthless to an attacker.