1,307 reputation
1412
bio website martinstoeckli.ch
location Switzerland
age 41
visits member for 2 years, 1 month
seen 1 hour ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working more and more with CSharp and use PHP for my spare time project, an internet lost-and-found office.

// Don't tell people not do something, explain the reasons and let them think for themselves.


Aug
17
revised What are the benefits and drawbacks of emailing a user a login token/link?
added 203 characters in body
Aug
17
answered What are the benefits and drawbacks of emailing a user a login token/link?
Aug
10
comment Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?
@user29349 - I'm not absolutely sure that i understood your question correctly, but keep in mind that today (2013) one can calculate about 3 Giga SHA1 hashes per second with common hardware. That leaves a lot of room for brute-forcing.
Jul
20
awarded  Popular Question
Jul
2
comment Session token is not changed on login?
@buherator - The OP's original question was more about whether a website can be secure, if it doesn't regenerate the session-id after a login.
Jul
2
answered Session token is not changed on login?
Jun
7
comment Password on login idea
One more thought about shoulder-surfing: Too complex instructions will be difficult to fulfill, when you don't see what you are doing (because of the ******* in the input field). The alternative of showing the password will of course decrease security.
Jun
1
awarded  Nice Question
May
6
comment Safe to connect to external drive?
Knowing that it doesn't answer your question, Windows users can hold down the <shift> key, until after the drive is mounted, this should prevent any autoplay and autorun scripts.
May
2
comment Could a password hash that's prone to more collisions provide better overall security?
@Johnny - I bet that you would be able to pick the real password in 99% of all cases, because most people do not choose absolutely random passwords. It may be more difficult for a computer to choose the right one, but i'm sure one could write software that can do a rating and find the most probable ones.
Apr
26
comment Is there any SQL injection for this PHP login example?
@TildalWave - Congratulations, you gained the endless patience award!
Apr
5
comment Encrypting short identifiers?
@TildalWave - Yes, it seems that he will never be able to change his avatar :-).
Apr
5
comment Encrypting short identifiers?
@TildalWave - I think a hash doesn't solve the problem. It would be convenient to have a function that encrypts the (auto-incremented) primary key of a database row, so you can find the row again. The encryption doesn't need to be strong, it should just obfuscate the primary key. And with a generated random key, you would need to check if such a key already exists.
Mar
22
revised When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?
added 395 characters in body
Mar
22
answered When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?
Mar
13
comment how to find injected code in SQL
Did you find the original problem, making SQL-injection possible at first place?
Mar
11
awarded  Yearling
Mar
11
revised How can I explain SQL injection without technical jargon?
Removed unnecessary stuff.
Mar
4
comment Client-Side Hashing to decrease value of password guessing heuristics
I think this meets exactly the question. One can imagine that an attacker just writes code that first makes the client-side hashing, and afterwards the server-side hashing. The input is still the weak password then and not the sent hash.
Mar
3
comment Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
Password reset links are expected, you will only click the link if you have demanded such an email before. That's a rule everybody should be able to understand.