4,390 reputation
1725
bio website
location
age
visits member for 3 years, 4 months
seen Jun 26 at 20:46

Jul
2
awarded  Popular Question
Jun
26
revised Encrypted files storage. How to simplify the password management scheme?
added 332 characters in body
Jun
26
revised Encrypted files storage. How to simplify the password management scheme?
added 309 characters in body
Jun
26
revised How does hashing work?
added 54 characters in body
Jun
26
revised Cryptographic algorithm to anonymise strings in pronounceable fashion?
added 86 characters in body
Jun
26
revised Cryptographic algorithm to anonymise strings in pronounceable fashion?
added 467 characters in body
Jun
26
answered Cryptographic algorithm to anonymise strings in pronounceable fashion?
May
28
awarded  Nice Answer
May
14
awarded  Notable Question
Mar
25
answered “It is safe if only Port 443/HTTPS is accessible from Internet!” Is it?
Mar
8
awarded  Yearling
Feb
25
awarded  Enlightened
Feb
25
awarded  Nice Answer
Feb
19
comment Hashing password with salt
Because if the salt value is the same for every hash in the list, it's like having more than one ticket for a drawing; a message you're hashing with that salt could be equal to any of the hash digests, and if so, you've just cracked that hash. If you want to crack another, you just pick up where you left off, because you know none of the messages you've tried have worked yet. This reduces the effective complexity of cracking hashes in the list. With unique salts, you have to focus on each individual hash to crack it, and if you want to crack more than one, you have to start over each time.
Feb
18
answered Hashing password with salt
Feb
4
awarded  Popular Question
Oct
10
answered Is “HTTPS” ~100% secure?
Sep
30
awarded  Explainer
Sep
2
comment How secure is this method to remember security questions?
In Microsoft's "Membership Provider" framework, used for ASP.NET sites, it is hashed using the same salt as the password, but that's an implementation detail; the framework does not allow you to retrieve the answer and perform any custom comparison. The answer is submitted to the underlying provider, and you get back a result saying whether it matched. How a match is determined is left to the actual provider; a system could be implemented that can perform an approximate match (case-insensitive, spell-checked, heuristic), but there would have to be an alternate way to secure the answers.
Aug
29
revised How secure is this method to remember security questions?
added 92 characters in body