3,780 reputation
1420
bio website
location
age
visits member for 2 years, 4 months
seen 13 hours ago

Jul
23
answered Are password complexity rules counterproductive?
Jul
23
comment Are password complexity rules counterproductive?
@grauwulf - the term is "Correct Horse Battery Staple" :)
Jul
23
comment How is Google Chrome managing authentication to sites?
Often, the server autologin is unique to a browser instance as well; the server sends a session token (completely unrelated to credentials) which it associates with the header information and source IP provided by the browser the user is logging in from. So, if that same token is provided from a FF browser when the user logged in with Chrome, or if the token's provided by a computer with a different source IP than the one used to process the login, the server refuses the request and invalidates the token. There are workarounds, but it's usually not so simple as copying a cookie.
Jul
23
comment Making a bitcoin-like secure mail protocol, how to tackle public keys?
The key data is the least of your worries. The number of files this system will maintain (apparently indefinitely) will grow in N*M fashion. Every node will be given every e-mail ever sent by anyone, and be expected to keep that file for some relatively long time. 10 users, whose computers are nodes in the web of trust, who each send an e-mail to all users (including themselves; what, you've never e-mailed yourself?), will result in 100 files stored on each user's computer, only 1/10 of which the user can actually do anything with. A web of hundreds or thousands would be unworkable.
Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
And I do understand the difference between sniffing encrypted traffic and listening on a compromised host. That's why the news stories flying round of the NSA cracking encryption algorithms is overblown; that's not what they're doing. However, if the attacker has a physical or electronic presence at your computer, you lose. That's day 1. Most attackers don't have this kind of access, and so failing to protect stored passwords just because one government entity has the possibility to see them transmitted is like not locking your front door because locksmiths exist.
Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
You assert it yourself, that if the attacker gets a copy of the database, they have your personal data whether they have your credentials or not. The implication you seem to ignore about your own statement is that they'll make a copy of it on their own system to analyze offline. Without having someone's credentials already, or at least a really good idea, the initial data breach is always read-only; you either sniff the data stream or lift the data store, given sufficient time they're identical, then analyze the data for credentials to get in and cause real damage.
Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
Wrong, wrong, wrong. The reason you have a password is to protect the ability to control your data. A database dump gives an attacker access to the information you have now. Plaintext login credentials give an attacker the ability to act on your behalf to change the data at will. Simply hashing a password isn't enough, however double-hashing is not unheard of (and the NSA's ability to sniff encrypted traffic is highly exaggerated). And you can tell people not to reuse passwords all you want; they still will, and it's still IT's fault if it was compromised.
Jul
2
awarded  Curious
Mar
8
awarded  Yearling
Feb
24
awarded  Great Answer
Dec
16
comment Is my developer's home-brew password security right or wrong, and why?
@Muhd - The problem with your supposition is that both algorithms are designed to add a nontrivial but acceptable amount of time complexity to the calculation (and the amount of complexity can be varied to achieve this balance). Running them in series means that you either double the time a user must wait for a legitimate password verification, or the strength of each algorithm must be reduced by half. Complexity is the enemy of security; the more it interferes with the status quo, the more likely your system will be "attacked" by your own users.
Nov
14
awarded  Nice Answer
Nov
1
answered Changing private keys
Sep
19
revised Are you aware of any CEO that went to jail because of Security Flaws?
added 185 characters in body
Aug
27
revised How to keep website passwords safe among employees?
added 475 characters in body
Aug
27
answered How to keep website passwords safe among employees?
Aug
27
answered Difference between Privilege and Permission
Aug
27
answered What are some examples of legal action taken as the result of a security breach?
Aug
27
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
added 234 characters in body
Aug
21
answered How can I know that the CA certificates in my computer have not been spoofed?