Reputation
4,860
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 8 28
Newest
 Nice Answer
Impact
~309k people reached

2d
comment SRP, or hash hashes over HTTPS?
I want what the user taps in on the device to not be what is sent over the wire (or trivially derivable as with Base64 encoding), and I want what's sent over the wire to not be what's stored on the server for verification. SRP and hashed hashes both accomplish this. SRP additionally guards against MITM compromise of the TLS channel (someone who can bypass TLS and see the hash could then authenticate with this API; the hash would still provide some protection against password reuse across systems), but if someone's willing to go that far to get the information involved, they can have it.
2d
asked SRP, or hash hashes over HTTPS?
Apr
28
asked Securing an error-reporting API against spamming
Mar
9
awarded  Nice Answer
Mar
8
awarded  Yearling
Feb
8
awarded  Nice Answer
Sep
26
awarded  Nice Answer
Sep
24
revised Future proof encryption possible in theory?
added 35 characters in body
Sep
24
comment Is the date that a password was last changed useful to an attacker?
@PwdRsch - No problem. The specific document requiring this password policy is UL 1981 Second Edition, which governs site certification for alarm central station automation and monitoring systems. I don't have the document in front of me so I can't quote chapter and verse.
Aug
28
comment What is the difference between http and https with a self-signed SSL certificate?
Something to keep in mind is that a self-signed certificate can be as secure as an externally-signed one; it simply has no trust chain extending to a common trusted root (like Verisign). If you trust the issuer of that certificate implicitly, you must take the additional step of installing the certificate in your CA store, telling your computer to trust it until you say otherwise. PKIs for corporate networks, in which a self-signed "golden key" is used as a trusted root to sign additional keys for company IT assets, are set up this way all the time.
Aug
28
comment Why is Tor over HTTPS insecure?
Good points all. In addition, it should be mentioned that an entity that controls both an entry and exit node to the TOR onion can trace any message that enters and exits the onion through these nodes. It is believed that the U.S. Government controls many computers acting as Tor nodes, and so has some ability to trace onion-routed traffic.
Aug
28
answered Is a server infrastructure fundamentally possible which the smartest person can't breach?
Jul
2
awarded  Popular Question
Jun
26
revised Encrypted files storage. How to simplify the password management scheme?
added 332 characters in body
Jun
26
revised Encrypted files storage. How to simplify the password management scheme?
added 309 characters in body
Jun
26
revised How does hashing work?
added 54 characters in body
Jun
26
revised Cryptographic algorithm to anonymise strings in pronounceable fashion?
added 86 characters in body
Jun
26
revised Cryptographic algorithm to anonymise strings in pronounceable fashion?
added 467 characters in body
Jun
26
answered Cryptographic algorithm to anonymise strings in pronounceable fashion?
May
28
awarded  Nice Answer