1,537 reputation
1613
bio website martinstoeckli.ch
location Switzerland
age 41
visits member for 2 years, 7 months
seen 2 hours ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working now mostly with CSharp and use PHP for my spare time project, an internet lost-and-found office.

// Don't tell people that they do wrong, explain the reasons and let them think for themselves.


Mar
12
comment Relationship of password strength and key strength
@user1066616 - Actually a key derrived from a password, cannot become more secure than the original password (same number of tries). As far as i know, the only advantage to generate a key is, that a slow key-derivation function will slow down brute-forcing a lot.
Mar
11
awarded  Yearling
Feb
2
comment Do you need to use the same number of rounds for everyone with bcrypt?
@user3100783 - Theoretically it would be ok to calculate the BCrypt hash client side, and only do a fast SHA512 on server side. This works, because the calculated BCrypt hash is a very strong "password", and for strong passwords a simple hash is enough. The problem is, that JavaScript is a slow language for this kind of calculation, so you will probably do fewer rounds and that weakens the security.
Jan
31
comment Do you need to use the same number of rounds for everyone with bcrypt?
@CodesInChaos - You could at least split the work on client and server, so the client could do the heavy work, while the server could hash with a "lite" algorithm before storing in the database. The question is whether you can rely on JavaScript at client side, but today probably we can.
Jan
31
answered Do you need to use the same number of rounds for everyone with bcrypt?
Dec
21
awarded  Nice Answer
Dec
20
comment For someone who has a key and ciphertext, is it possible to find out what encryption algorithm was used?
@AliAhmad - I don't get it, every encrytion scheme should depend on a key, the key is the only thing that must remain secret. Did i miss something?
Dec
16
revised Can't brute force password cracking somehow be throttled?
Sorry, wrong word
Dec
16
revised Can't brute force password cracking somehow be throttled?
added 65 characters in body
Dec
16
answered Can't brute force password cracking somehow be throttled?
Nov
12
comment Is it useful to protect hashed password with encryption?
@oleksii - Not really, the salt prevents using rainbow-tables and with unique salts, each password has to be brute-forced separately. Against brute-forcing a single password, a salt will not help. Today you can calculate several Giga hashes per second with common hardware, that's why you need a slow algorithm. Even with a slow algorithm you can test for the most used passwords, this is kind of a dictionary attack. I would invite you to have a look at my tutorial about secure password storing.
Nov
12
revised Is it useful to protect hashed password with encryption?
added 117 characters in body
Nov
12
answered Is it useful to protect hashed password with encryption?
Nov
8
revised How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?
added 20 characters in body
Nov
8
answered How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?
Oct
25
comment Is this site vulnerable to sql injection?
Sure, error messages can give hints about the system in use, that's why they should never reach the page viewed by the user, instead a general message should be displayed. But this doesn't mean your page is vulnerable to SQL-injection.
Oct
25
comment Is this site vulnerable to sql injection?
Such an error message should not be displayed on a productive website, but why do you think it has something to do with SQL-injection?
Oct
18
answered Altering passwords before storing
Oct
15
comment comparing password hashing algorithms - PoC ideas?
The number of hashes calculated by oclHashcat with common hardware are very convincing. For plain SHA-256 this is more than 1 Giga hashes per second, compared with an english dictionary containing about 150000 words... well that makes a fraction of a millisecond.
Oct
11
comment Does using Bcrypt to encrypt credit card numbers satisfy PCI compliance?
@jpkrohling - You should think of the salt as a known value, it is not a secret. It will not make it harder to brute-force a single value, but can prevent an attacker to build a rainbow-table to get all numbers at once.