124,341 reputation
20241436
bio website bolet.org/~pornin
location Quebec City, Canada
age 38
visits member for 3 years, 4 months
seen 58 mins ago

Cryptographer, programmer in several languages (C, Java, several assemblies, Pascal, Forth...). I also have a life.


58m
reviewed Approve suggested edit on How do I hack this login page by using SQL injection?
17h
answered How to sign data with OpenSSL 0.9.8?
17h
answered What prevents me from using ARP poisoning to force a client to use HTTP?
19h
answered Are there any “offline” open source software with I can check my HTTPS site?
22h
reviewed Approve suggested edit on How many Stack Exchange logins should I have?
23h
reviewed Approve suggested edit on How do you identify a website's form-type?
1d
awarded  Nice Answer
1d
reviewed Approve suggested edit on PCI Compliance relating to 'other' passwords
1d
comment Hashing password for secure storage (generating salt)
From my experience in cryptography, I would be very surprised if there was a problem with using the same password with distinct hash functions and distinct hash names. This would be a very unexpected structural relation between these hash functions. This is not a proof but that does not seem overly unsafe to me.
1d
comment Hashing password for secure storage (generating salt)
Consider user 'bob' on site 'bysoft.com` vs user 'bobby' on site 'soft.com`. Both cases would end up with the same pseudo-salt. The separator character is a cheap way to avoid such cases.
1d
reviewed Approve suggested edit on Why is the SSL handshake not shown in Wireshark?
1d
awarded  Enlightened
1d
awarded  Nice Answer
1d
answered Hashing password for secure storage (generating salt)
1d
answered What's wrong with my own authentication scheme?
1d
comment What to do about websites that store plain text passwords
As I said, it is less an issue than the sending out as an email. But this highlights the need for site-specific passwords. I never use the same password for two distinct services -- and you should do the same, because you cannot know how (in)competent the sysadmins of any site are. They may store the password in plaintext, or, even worse, send it by email to poorly validated addresses.
1d
comment How are two systems able to set up a secure SSH tunnel over a public connection?
The "certificate" stricto sensu contains only the public part; the private key is not part of the "certificate" (but many people use the term "certificate" to designate both the certificate and its private key). And yes, there are big numbers encoded in these objects.
1d
comment How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
If p and q are two distinct prime integers, and n = pq, then there are exactly four positive integers which divide n, and these are 1, p, q, and n itself. The 1 and n values are often said to be "trivial divisors" while p and q are difficult to compute. Strictly speaking, only p and q are called "factors", which is why "divisor" would be a more exact terminology here.
1d
answered How are two systems able to set up a secure SSH tunnel over a public connection?
1d
reviewed Approve suggested edit on Squid upgrade HTTP to HTTPS