4,325 reputation
1723
bio website
location
age
visits member for 3 years, 2 months
seen May 18 at 15:10

May
14
awarded  Notable Question
Mar
25
answered “It is safe if only Port 443/HTTPS is accessible from Internet!” Is it?
Mar
8
awarded  Yearling
Feb
25
awarded  Enlightened
Feb
25
awarded  Nice Answer
Feb
19
comment Hashing password with salt
Because if the salt value is the same for every hash in the list, it's like having more than one ticket for a drawing; a message you're hashing with that salt could be equal to any of the hash digests, and if so, you've just cracked that hash. If you want to crack another, you just pick up where you left off, because you know none of the messages you've tried have worked yet. This reduces the effective complexity of cracking hashes in the list. With unique salts, you have to focus on each individual hash to crack it, and if you want to crack more than one, you have to start over each time.
Feb
18
answered Hashing password with salt
Feb
4
awarded  Popular Question
Oct
10
answered Is “HTTPS” ~100% secure?
Sep
30
awarded  Explainer
Sep
2
comment How secure is this method to remember security questions?
In Microsoft's "Membership Provider" framework, used for ASP.NET sites, it is hashed using the same salt as the password, but that's an implementation detail; the framework does not allow you to retrieve the answer and perform any custom comparison. The answer is submitted to the underlying provider, and you get back a result saying whether it matched. How a match is determined is left to the actual provider; a system could be implemented that can perform an approximate match (case-insensitive, spell-checked, heuristic), but there would have to be an alternate way to secure the answers.
Aug
29
revised How secure is this method to remember security questions?
added 92 characters in body
Aug
29
answered How secure is this method to remember security questions?
Aug
11
revised How does hashing work?
added 10 characters in body
Jul
23
answered Are password complexity rules counterproductive?
Jul
23
comment Are password complexity rules counterproductive?
@grauwulf - the term is "Correct Horse Battery Staple" :)
Jul
23
comment How is Google Chrome managing authentication to sites?
Often, the server autologin is unique to a browser instance as well; the server sends a session token (completely unrelated to credentials) which it associates with the header information and source IP provided by the browser the user is logging in from. So, if that same token is provided from a FF browser when the user logged in with Chrome, or if the token's provided by a computer with a different source IP than the one used to process the login, the server refuses the request and invalidates the token. There are workarounds, but it's usually not so simple as copying a cookie.
Jul
23
comment Making a bitcoin-like secure mail protocol, how to tackle public keys?
The key data is the least of your worries. The number of files this system will maintain (apparently indefinitely) will grow in N*M fashion. Every node will be given every e-mail ever sent by anyone, and be expected to keep that file for some relatively long time. 10 users, whose computers are nodes in the web of trust, who each send an e-mail to all users (including themselves; what, you've never e-mailed yourself?), will result in 100 files stored on each user's computer, only 1/10 of which the user can actually do anything with. A web of hundreds or thousands would be unworkable.
Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
And I do understand the difference between sniffing encrypted traffic and listening on a compromised host. That's why the news stories flying round of the NSA cracking encryption algorithms is overblown; that's not what they're doing. However, if the attacker has a physical or electronic presence at your computer, you lose. That's day 1. Most attackers don't have this kind of access, and so failing to protect stored passwords just because one government entity has the possibility to see them transmitted is like not locking your front door because locksmiths exist.
Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
You assert it yourself, that if the attacker gets a copy of the database, they have your personal data whether they have your credentials or not. The implication you seem to ignore about your own statement is that they'll make a copy of it on their own system to analyze offline. Without having someone's credentials already, or at least a really good idea, the initial data breach is always read-only; you either sniff the data stream or lift the data store, given sufficient time they're identical, then analyze the data for credentials to get in and cause real damage.