Reputation
1,582
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
2 11 26
Newest
 Caucus
Impact
~132k people reached

Jul
14
awarded  Caucus
May
20
comment Can I use the same password both for SRP and for client-side encryption?
@simbo1905 Thanks for your suggestions, actually the odds of a randomly generated salt colliding are negligible, though adding a unique constraint doesn't hurt, so I'll do it anyway. About the offline dictionary attack, encripting the verifier is usually not a feasible option (where would I store the key?) but what protects against this scenario is the password hashing itself (in SRP the hash must be done to each password candidate in order for the password to verify; the fact that it's an offline attack doesn't change that).
Apr
25
asked Choosing a group of symbols that contains a password
Apr
24
comment Is it safe to store password in HTML5 sessionStorage?
@juanitogan Agreed. I rephrased the statement a bit, to make this point more clear.
Apr
24
revised Is it safe to store password in HTML5 sessionStorage?
added 65 characters in body
Apr
2
awarded  Notable Question
Mar
4
answered Is this a good approach to secure my REST API?
Feb
16
comment How secure is TeamViewer for simple remote support?
@Pacerier uh, it's been almost 3 years since I asked this question, but if I recall correctly it's this part at part 3: "Keep in mind that the initial RequestRoute2 response, containing the public key of the destination, is not authenticated in any way (...), so it can be trivially man-in- the-middled..." Also: "If peer-to-peer encryption negotiation fails for any reason, one of the clients (...) will send a CMD_RequestNoEncryption command, which will turn off all peer-to-peer encryption for the session. Turning off encryption is silent, with no user-noticeable effect."
Jan
14
awarded  Yearling
Dec
22
awarded  Announcer
Nov
18
awarded  Good Question
Nov
8
awarded  Nice Question
Aug
14
accepted What are the implications of storing sensitive data in bookmarklets?
Jul
2
awarded  Curious
Apr
30
accepted Is it important to use a slow hash in htpasswd?
Apr
28
comment Is it important to use a slow hash in htpasswd?
"The credentials stored in the file might be used on other computing systems or services" yes, that might be a valid reason indeed. Otherwise, what would be the point of cracking the passwords? The files this password protects are just there - sitting alongside the .htpasswd file - the attacker can just grab them already! But if the same passwords also protects something else (the likelyhood of which I can't guess), then I can see the benefit of properly protecting them.
Apr
28
asked Is it important to use a slow hash in htpasswd?
Apr
2
awarded  Notable Question
Mar
10
answered Storing passwords in reversible form - a genuine use-case
Jan
31
comment What are the implications of storing sensitive data in bookmarklets?
BTW I'm not a native english speaker, forgive me if I wasn't clear enough