1,572 reputation
1613
bio website martinstoeckli.ch
location Switzerland
age 42
visits member for 2 years, 9 months
seen 3 hours ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working now mostly with CSharp and use PHP for my spare time project, an internet lost-and-found office.

// Don't tell people that they do wrong, explain the reasons and let them think for themselves.


2d
revised Is SSL more secure than encoding?
edited body
2d
answered Is SSL more secure than encoding?
Sep
29
comment PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
@ggo - Of course it depends on the importance of the data you want to protect, but at least you should explain it in the GUI where the administrator will enter his password. Even companies like Microsoft expect to tell them a generated token for activating their software, such a token would be a strong password.
Sep
29
comment PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
@ggo - Well then the PBKDF is indeed the way to go, i edited my answer accordingly.
Sep
29
revised PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
added 588 characters in body
Sep
28
revised PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
edited body
Sep
28
answered PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
Sep
25
revised Why don't sites implement a system where a wrong password causes a 3 second delay?
edited body
Sep
25
answered Why don't sites implement a system where a wrong password causes a 3 second delay?
Sep
19
comment What are the differences between dictionary attack and brute force attack?
Most password cracker tools offer hybrid modes, where they prefer words from a dictionary, test variations, and finally test with brute-forcing. So you cannot always distinguish between the attacks, have a look at the attack-modes of hashcat for example.
Sep
13
comment Is my custom password hashing algorithm insecure?
Another thing you gain is convenience, the password_hash() function will pack all necessary parameters into the resulting hash-value (salt / cost factor / algo). This string you can store in a single database field.
Sep
10
comment Is there a brute-force attack similar to what they demonstrate in movies
Ahh yes, i just ignored that part, you are right then.
Sep
10
comment Is there a brute-force attack similar to what they demonstrate in movies
@sq33G - Timing attacks are very unlikely, because you would measure time differences comparing the hash and not the password itself. Have a look at this question.
Sep
10
comment Is there a brute-force attack similar to what they demonstrate in movies
Assuming that the password is hashed with an appropriate algorithm, you could only measure time differences comparing the hash, not the password, so you get no useful information.
Sep
3
comment How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
What you are describing is SSL-strip. The problem is, that the server cannot detect whether the page was requested by the user or by a MITM. Even if there would be something like safe cookies, the MITM could transform them to normal cookies easily.
Aug
25
revised Should BCRYPT be used for client-side password hashing
added 338 characters in body
Aug
25
answered Should BCRYPT be used for client-side password hashing
Aug
11
awarded  Notable Question
Aug
8
answered How is Truecrypt any safer than just password-protection?
Jun
25
answered HTML Entities to hide Email Addresses