197 reputation
3
bio website
location Vancouver, Canada
age
visits member for 4 years, 1 month
seen Oct 21 at 23:14

Sep
19
comment Is a “security measure” that doesn't provide a security benefit actually harmful?
The theory is that by forcing a reauth reduces the likelihood that an out of pattern transaction is the result of a session hijacking or replay attack. Also, sorry for the lag in response o_O
Sep
16
comment Why do some websites and programs restrict password characteristics?
djangoproject.com/weblog/2013/sep/15/security
Jan
10
comment Why do some websites and programs restrict password characteristics?
hashing by itself won't create a denial of service condition, but recommended approaches for using pbkdf, scrypt, or bcrypt style 'password stretching' which call for a thousand or more iterations of the hashing algorithm for each authentication on an arbitrarily large data set, it could have a serious impact on server performance. In this case it makes sense to establish a maximum length for a password to prevent an impact to the performance of the server.
Jan
10
awarded  Editor
Jan
10
revised Why do some websites and programs restrict password characteristics?
added 1096 characters in body; added 6 characters in body
Jan
10
comment Why do some websites and programs restrict password characteristics?
Since my first question missed the mark, I provide a separate answer. The primary reason is that limits are required. Although the concern regarding the storage space and the marginal load of calculating the hash of an arbitrary length chunk of data is accurate, there are some issues.
Jan
10
comment Why do some websites and programs restrict password characteristics?
Hmm.. re-reading the question, you might be correct. Either way, hopefully my answer is useful to someone ;)
Jan
10
answered Why do some websites and programs restrict password characteristics?
Dec
9
awarded  Precognitive
Dec
3
comment Is a “security measure” that doesn't provide a security benefit actually harmful?
The example you are using is not a very good one. Many sites force a re-authentication of a user when processing sensitive transactions (for example, a financial transfer that is outside of the pattern of financial transactions that have been done in the past). Other than the specific example, I agree with the rest of your comment.
Nov
19
awarded  Teacher
Nov
19
answered Powerful security tools to use in penetration testing
Nov
19
comment What tools are available to assess the security of a web application?
Probably, but bias exists in any organization. OWASP had already been listed in other comments so there was no need to repeat it.
Nov
12
answered What tools are available to assess the security of a web application?