meta user
network profile
| bio | website | martinstoeckli.ch |
|---|---|---|
| location | Switzerland | |
| age | 40 | |
| visits | member for | 1 year, 2 months |
| seen | yesterday | |
| stats | profile views | 119 |
I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working more and more with CSharp and use PHP for my spare time project, an internet lost-and-found office.
|
Nov 29 |
answered | Does shuffling a hashed password increase its security? |
|
Nov 21 |
comment |
Is there a table that compares hashing algorithms by speed, relatively (machine independent) @Eran Medan - If you look at the implementation of Bcrypt, you will see, that in each iteration, the original key and the salt are mixed up with the result of the last iteration. So it's not exactly the same as just iterating a number of times, using the result as the input for the next iteration. |
|
Nov 21 |
revised |
Is there a table that compares hashing algorithms by speed, relatively (machine independent) added 357 characters in body |
|
Nov 21 |
answered | Is there a table that compares hashing algorithms by speed, relatively (machine independent) |
|
Nov 7 |
comment |
How can a web application protect IE users when this browser doesn't support HSTS? Your last point about the JavaScript message is interesting. Of course it can be stripped away, but it would prevent attacks from automated tools. You could improve it by checking HTTPS and comparing the domain, so if an attacker offers SSL from his own domain, it would give a warning too. |
|
Nov 5 |
revised |
Password Hashing add salt + pepper or is salt enough? added 66 characters in body |
|
Nov 5 |
comment |
Password Hashing add salt + pepper or is salt enough? @Jacco - It is PHP, but the function bcrypt is fictitious, because PHP itself does not provide such a function yet (before 5.5), the function hash_hmac exists though. I tried to edit the answer, so all confusing parts are removed, what do you think i could improve more? |
|
Nov 5 |
revised |
Password Hashing add salt + pepper or is salt enough? added 66 characters in body |
|
Nov 2 |
comment |
Password Hashing add salt + pepper or is salt enough? @Jacco - Just added an example of using a hmac. |
|
Nov 2 |
revised |
Password Hashing add salt + pepper or is salt enough? Added example with hmac |
|
Nov 2 |
revised |
Password Hashing add salt + pepper or is salt enough? added 8 characters in body |
|
Nov 2 |
answered | Password Hashing add salt + pepper or is salt enough? |
|
Oct 18 |
comment |
Whats the probability of a personal computer being hacked? In Adobe Reader goto Edit/Preferences..., switch to the JavaScript tab and disable JavaScript, you will never miss it... |
|
Oct 17 |
comment |
How secure are passwords made of whole english sentences Assume that the "OP" is really interested in security and does all the things right, then it is a good question. |
|
Oct 17 |
answered | How secure are passwords made of whole english sentences |
|
Oct 8 |
awarded | Scholar |
|
Oct 8 |
accepted | How to apply a pepper correctly to bcrypt? |
|
Oct 8 |
revised |
How to apply a pepper correctly to bcrypt? Added note about order of concatenating password and pepper |
|
Oct 7 |
comment |
How to apply a pepper correctly to bcrypt? @StephenTouset - A HMAC afterwards would scramble up salt and cost factor. Do you mean to split up these parameters, apply the HMAC and afterwards rejoin it with the salt and cost factor? Encryption could be a solution, but why not encrypt the password before hashing it? |
|
Oct 7 |
revised |
How to apply a pepper correctly to bcrypt? added 4 characters in body |
