1,622 reputation
1713
bio website martinstoeckli.ch
location Switzerland
age 42
visits member for 3 years, 1 month
seen 52 mins ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working now mostly with CSharp and use PHP for my spare time project, an internet lost-and-found office.


Sep
13
comment Is my custom password hashing algorithm insecure?
Another thing you gain is convenience, the password_hash() function will pack all necessary parameters into the resulting hash-value (salt / cost factor / algo). This string you can store in a single database field.
Sep
10
comment Is there a brute-force attack similar to what they demonstrate in movies
Ahh yes, i just ignored that part, you are right then.
Sep
10
comment Is there a brute-force attack similar to what they demonstrate in movies
@sq33G - Timing attacks are very unlikely, because you would measure time differences comparing the hash and not the password itself. Have a look at this question.
Sep
10
comment Is there a brute-force attack similar to what they demonstrate in movies
Assuming that the password is hashed with an appropriate algorithm, you could only measure time differences comparing the hash, not the password, so you get no useful information.
Sep
3
comment How to avoid session fixation (Login CSRF) by MitM attack without HSTS?
What you are describing is SSL-strip. The problem is, that the server cannot detect whether the page was requested by the user or by a MITM. Even if there would be something like safe cookies, the MITM could transform them to normal cookies easily.
Aug
25
revised Should BCRYPT be used for client-side password hashing
added 338 characters in body
Aug
25
answered Should BCRYPT be used for client-side password hashing
Aug
11
awarded  Notable Question
Aug
8
answered How is Truecrypt any safer than just password-protection?
Jun
25
answered HTML Entities to hide Email Addresses
Jun
24
comment Aren't password managers still incredibly risky?
Passphrases are very strong passwords and are not difficult to memorize.
Jun
18
comment Can HSTS be defeated?
It depends entirely on the implementation of each browser, how the header is handled and stored. But i would be surprised when clearing the headers would be accessible by a script.
Jun
12
comment is it illegal to share customer credit card data
As far as i know storing credit card information requires to comply with the PCI standard. I'm pretty sure that after reading the requirements, your customer will reconsider implementing this feature.
May
30
awarded  Nice Answer
May
27
comment Who can carry out Man-in-the-Middle (MITM) attacks?
If you have the time, then have a look at Moxie Marlinspikes video about SSL-strip. He talks about setting up a public WLAN hotspot for demonstration.
May
26
answered Authenticated sessions and Man in the middle
May
1
comment Password Hashing Without a Unique Salt
Whether your hashing scheme is sufficient you will find out as soon as your hashes where stolen, then you will have to contact your customers, and tell them that unfortunately their passwords are not well protected. I cannot imagine a modification so huge, that it is worth the risk. Every hashing scheme must be able to change to more secure standards from time to time, this is not only a one time job.
Apr
26
comment How to apply a pepper correctly to bcrypt?
@Powerman - It is surely a good idea to ask the users for strong passwords, but unfortunately it's not under your control. The password "Password-2014" will pass most checks, but is not very strong. As for SQLi, SQL-injection can be prevented easily with parametrized queries, only third party libraries are a problem. Reading files from the server with SQL is even much more difficult and works only with certain database configurations, so in my opinion encrypting with a server-side key should be done in any case.
Apr
25
comment How to apply a pepper correctly to bcrypt?
@Powerman - The purpose of the key is, that the attacker needs to gain additional privileges on the server (he needs the key, the database alone won't do), not to make the hash more safe (this is the job of BCrypt). Of course if the encryption is done wrong you may get the hashes, that's what Thomas mentioned, but this is a question of using a good library. The advantage is, that you can exchange the key whenever you have need to, even periodically. Another discussed point is, that you do not interfere in any way with the hash algorithm.
Apr
25
comment How to apply a pepper correctly to bcrypt?
@Powerman - The pseudo code is based on the PHP implementation of the hash_hmac() function.