97,905 reputation
12148273
bio website
location
age 70
visits member for 3 years, 9 months
seen 5 mins ago

I SHALL DEVOUR YOUR HEART AND FEAST ON YOUR SOUL (so don't bug me).


Jul
10
awarded  Nice Answer
Jul
10
answered Why are there very expensive and cheap SSL same type certificates?
Jul
10
answered Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3
Jul
10
awarded  Nice Answer
Jul
9
awarded  Nice Answer
Jul
9
comment How to do client side hashing of password using BCrypt?
That kind of client-side hashing is called "server relief". There is a lot of theory on that subject. I suggest beginning with this answer.
Jul
9
comment How to do client side hashing of password using BCrypt?
Using a combination of the user name and the server name as salt is still better; you still have salt collisions when a user changes his password (the old and the new hash can still be attacked in parallel). The really general method for doing client-side hashing is a two-step protocol where the client first sends the target user name, then gets the salt, computes the hash with that salt, and sends the result back -- and the server must still do one extra hashing (a fast one) so that what the client sends is not what the server stores.
Jul
9
comment How to do client side hashing of password using BCrypt?
Using a static salt on the client really removes all security implied by the client-side hashing. With a static salt, the hash result becomes the new "password" that grants access when sent to the server. By using a "static salt" you just spent a lot of computing cycles for nothing. Using the user name as salt is much better, but still implies collisions that help the attacker (i.e. the attacker may optimize things by precomputing hashes, e.g. as a rainbow table, for user name "admin", because most site using that software will have a user named "admin").
Jul
9
awarded  Guru
Jul
9
awarded  Good Answer
Jul
8
awarded  Nice Answer
Jul
8
awarded  Good Answer
Jul
8
answered How to do client side hashing of password using BCrypt?
Jul
7
awarded  Nice Answer
Jul
7
answered Does a solution exist for transferring large files across a network that is faster, yet just as secure as scp?
Jul
7
awarded  Nice Answer
Jul
7
answered HTTPS - Can server see details of client side certificate?
Jul
7
comment What layer is TLS?
To sum up, you usually know that TLS is there because of the context (e.g. if it is on TCP port 443, then chances are that it is TLS), and you can heuristically recognize TLS records with a low false-positive rate. E.g., just yesterday, I was looking at some RDP packets, and right in the middle of them I recognized an encapsulated TLS handshake. Notably, the handshake implies the sending of a certificate from the server, and the encoded certificate really stands out in hexadecimal dumps (well, for me at least).
Jul
7
comment What layer is TLS?
Usually, TLS happens because client and server agree that TLS ought to happen. For instance, when connecting to a `https://' URL, a Web browser just knows that it should begin some TLS, because that's what the 's' in 'https' means. From the outside, you can usually infer that TLS is occurring because you recognize the TLS record headers. Each record begins with a five-byte header: one byte for the record type (0x14 to 0x17), then protocol version (0x03 followed by 0x00, 0x01, 0x02 or 0x03), then record length (over two bytes, big-endian).
Jul
7
answered What layer is TLS?