meta user
network profile
| bio | website | |
|---|---|---|
| location | Vancouver, Canada | |
| age | ||
| visits | member for | 2 years, 6 months |
| seen | Feb 27 '12 at 5:13 | |
| stats | profile views | 7 |
|
Jan 10 |
comment |
Why do some websites and programs restrict password characteristics? hashing by itself won't create a denial of service condition, but recommended approaches for using pbkdf, scrypt, or bcrypt style 'password stretching' which call for a thousand or more iterations of the hashing algorithm for each authentication on an arbitrarily large data set, it could have a serious impact on server performance. In this case it makes sense to establish a maximum length for a password to prevent an impact to the performance of the server. |
|
Jan 10 |
awarded | Editor |
|
Jan 10 |
revised |
Why do some websites and programs restrict password characteristics? added 1096 characters in body; added 6 characters in body |
|
Jan 10 |
comment |
Why do some websites and programs restrict password characteristics? Since my first question missed the mark, I provide a separate answer. The primary reason is that limits are required. Although the concern regarding the storage space and the marginal load of calculating the hash of an arbitrary length chunk of data is accurate, there are some issues. |
|
Jan 10 |
comment |
Why do some websites and programs restrict password characteristics? Hmm.. re-reading the question, you might be correct. Either way, hopefully my answer is useful to someone ;) |
|
Jan 10 |
answered | Why do some websites and programs restrict password characteristics? |
|
Dec 9 |
awarded | Precognitive |
|
Dec 3 |
comment |
Is a “security measure” that doesn't provide a security benefit actually harmful? The example you are using is not a very good one. Many sites force a re-authentication of a user when processing sensitive transactions (for example, a financial transfer that is outside of the pattern of financial transactions that have been done in the past). Other than the specific example, I agree with the rest of your comment. |
|
Nov 19 |
awarded | Teacher |
|
Nov 19 |
answered | Powerful security tools to use in penetration testing |
|
Nov 19 |
comment |
What tools are available to assess the security of a web application? Probably, but bias exists in any organization. OWASP had already been listed in other comments so there was no need to repeat it. |
|
Nov 12 |
answered | What tools are available to assess the security of a web application? |
