Reputation
4,870
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 8 28
Newest
 Nice Answer
Impact
~309k people reached

Jul
23
comment What is a good analogy to explain to a layman why passwords should be hashed?
Wrong, wrong, wrong. The reason you have a password is to protect the ability to control your data. A database dump gives an attacker access to the information you have now. Plaintext login credentials give an attacker the ability to act on your behalf to change the data at will. Simply hashing a password isn't enough, however double-hashing is not unheard of (and the NSA's ability to sniff encrypted traffic is highly exaggerated). And you can tell people not to reuse passwords all you want; they still will, and it's still IT's fault if it was compromised.
Jul
2
awarded  Curious
Mar
8
awarded  Yearling
Feb
24
awarded  Great Answer
Dec
16
comment Is my developer's home-brew password security right or wrong, and why?
@Muhd - The problem with your supposition is that both algorithms are designed to add a nontrivial but acceptable amount of time complexity to the calculation (and the amount of complexity can be varied to achieve this balance). Running them in series means that you either double the time a user must wait for a legitimate password verification, or the strength of each algorithm must be reduced by half. Complexity is the enemy of security; the more it interferes with the status quo, the more likely your system will be "attacked" by your own users.
Nov
14
awarded  Nice Answer
Nov
1
answered Changing private keys
Sep
19
revised Are you aware of any CEO that went to jail because of Security Flaws?
added 185 characters in body
Aug
27
revised How to keep website passwords safe among employees?
added 475 characters in body
Aug
27
answered How to keep website passwords safe among employees?
Aug
27
answered Difference between Privilege and Permission
Aug
27
answered What are some examples of legal action taken as the result of a security breach?
Aug
27
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
added 234 characters in body
Aug
21
answered How can I know that the CA certificates in my computer have not been spoofed?
Aug
20
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
deleted 7 characters in body
Aug
20
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
deleted 1016 characters in body
Aug
20
answered How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
Aug
20
revised How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?
deleted 25 characters in body
Aug
20
comment How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks?
In other words, if you don't potentially want the world to know your home WAP's MAC address, don't broadcast its SSID.
Aug
16
revised Cheating or service disruption by altering client-side code
added 93 characters in body