4,345 reputation
1724
bio website
location
age
visits member for 3 years, 2 months
seen 3 hours ago

Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
You assert it yourself, that if the attacker gets a copy of the database, they have your personal data whether they have your credentials or not. The implication you seem to ignore about your own statement is that they'll make a copy of it on their own system to analyze offline. Without having someone's credentials already, or at least a really good idea, the initial data breach is always read-only; you either sniff the data stream or lift the data store, given sufficient time they're identical, then analyze the data for credentials to get in and cause real damage.
Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
Wrong, wrong, wrong. The reason you have a password is to protect the ability to control your data. A database dump gives an attacker access to the information you have now. Plaintext login credentials give an attacker the ability to act on your behalf to change the data at will. Simply hashing a password isn't enough, however double-hashing is not unheard of (and the NSA's ability to sniff encrypted traffic is highly exaggerated). And you can tell people not to reuse passwords all you want; they still will, and it's still IT's fault if it was compromised.
Jul
2
awarded  Curious
Mar
8
awarded  Yearling
Feb
24
awarded  Great Answer
Dec
16
comment Is my developer's home-brew password security right or wrong, and why?
@Muhd - The problem with your supposition is that both algorithms are designed to add a nontrivial but acceptable amount of time complexity to the calculation (and the amount of complexity can be varied to achieve this balance). Running them in series means that you either double the time a user must wait for a legitimate password verification, or the strength of each algorithm must be reduced by half. Complexity is the enemy of security; the more it interferes with the status quo, the more likely your system will be "attacked" by your own users.
Nov
14
awarded  Nice Answer
Nov
1
answered Changing private keys
Sep
19
revised Are you aware of any CEO that went to jail because of Security Flaws?
added 185 characters in body
Aug
27
revised How to keep website passwords safe among employees?
added 475 characters in body
Aug
27
answered How to keep website passwords safe among employees?
Aug
27
answered Difference between Privilege and Permission
Aug
27
answered What are some examples of legal action taken as the result of a security breach?
Aug
27
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
added 234 characters in body
Aug
21
answered How can I know that the CA certificates in my computer have not been spoofed?
Aug
20
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
deleted 7 characters in body
Aug
20
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
deleted 1016 characters in body
Aug
20
answered How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
Aug
20
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
deleted 25 characters in body
Aug
20
comment How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
In other words, if you don't potentially want the world to know your home WAP's MAC address, don't broadcast its SSID.