network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 2 months |
| seen | May 13 at 14:37 | |
| stats | profile views | 45 |
|
Feb 14 |
answered | What is the point of hashing passwords? |
|
Feb 12 |
comment |
Banning specific passwords? True. This could also be explicitly stated in advance as the rule "the password cannot consist of or contain any of the terms on the 'banned list'", providing some sort of link that would allow the user to view said list and the reasons words are on that list. I'm just worried that that might actually be going to far in itself, providing information to an attacker that can feed a cracking algorithm ("these strings will not be in the user's password"). But, would those entries really provide much of an advantage, when really all they're doing is removing the obvious ones he'd try first? |
|
Feb 12 |
comment |
Banning specific passwords? I guess I agree with the maintenance aspect and the use of more sophisticated cracking tools based on hints more tailored to the user. This measure was supposed to be a relatively simple guard against low-hanging fruit. Would a more descriptive error message about why the password was rejected help obviate the concerns with user frustration? |
|
Feb 7 |
comment |
Does a binary executable have to have some critical plain-text components? There is a field of cryptography called "white-box cryptography", whose goal is to develop algorithms that incorporate the secret required for decryption into the code itself in an indistinguishable way. It's still executable code, but nothing in it can be discretely identified as being a "key" or even a specific piece of it. The ideal would be an algorithm that an attacker could watch executing in a conceptual "white box", see every register, memory location and instruction step by step, and still be unable to reverse-engineer the secret. |
|
Feb 6 |
answered | Why are vulnerabilities and lack of security possible in computers? |
|
Feb 5 |
comment |
What is certificate pinning? Good answer, but it also depends on the browser; Google's Chrome browser pins the certificates for Google sites, so in your example, a Chrome browser would only trust specific google.com certificates known to be the correct ones (or the ones signed by the Google Internet Authority). |
|
Feb 5 |
revised |
Banning specific passwords? added 69 characters in body |
|
Feb 5 |
comment |
What is the current status of trust management? The assertion that "people are still basically honest" is our primary and best counter-measure. You're basically asking how we can trust code that anyone else has written. Well, because most people are honest, that code was first probably written by an honest person, and second, that code was almost surely reviewed by at least one honest person (this is why "open-source" algorithms and implementations are a good thing). As long as you can reasonably believe either of those things, the code is generally trustworthy. |
|
Feb 4 |
revised |
Good, simple list of reasons that email is inherently insecure added 92 characters in body |
|
Feb 4 |
revised |
How to implement a Web of Trust? added 196 characters in body |
|
Feb 4 |
answered | Good, simple list of reasons that email is inherently insecure |
|
Feb 4 |
comment |
Are you aware of any CEO that went to jail because of Security Flaws? Unfortunately, yes. The CEO's job, even the CTO's, does not include knowing every last detail of the inner workings of his operation. The analogy is like driving a car; you don't have to know the exact specifications of any car you get behind the wheel of in order to drive it. By the same token, in the U.S. at least, if something breaks on a car that's been regularly maintained, you're not liable; if anyone is, it's your mechanic, who should know every detail and is responsible, provided you let him, for keeping the car in good order. |
|
Feb 4 |
accepted | Reversible, recoverable user data encryption scheme |
|
Feb 4 |
accepted | BCrypt+SHA256 vs PBKDF2-SHA256 |
|
Feb 4 |
accepted | Is the date that a password was last changed useful to an attacker? |
|
Feb 4 |
revised |
Salted hashes vs HMAC? added 51 characters in body |
|
Feb 4 |
accepted | Banning specific passwords? |
|
Feb 4 |
revised |
Are you aware of any CEO that went to jail because of Security Flaws? added 5 characters in body |
|
Feb 4 |
awarded | Necromancer |
|
Feb 1 |
revised |
Banning specific passwords? added 81 characters in body |
