meta user
network profile
| bio | website | martinstoeckli.ch |
|---|---|---|
| location | Switzerland | |
| age | 40 | |
| visits | member for | 1 year, 2 months |
| seen | 5 hours ago | |
| stats | profile views | 119 |
I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working more and more with CSharp and use PHP for my spare time project, an internet lost-and-found office.
|
Oct 7 |
comment |
How to apply a pepper correctly to bcrypt? Thanks a lot for this helpful answer, especially the tip about binary output. So you see no obvious problems with just concatenating password and pepper? |
|
Oct 7 |
awarded | Student |
|
Oct 7 |
asked | How to apply a pepper correctly to bcrypt? |
|
Sep 30 |
comment |
PHP crypt() trims the salt as it would be too long Nice and short! |
|
Sep 30 |
comment |
PHP crypt() trims the salt as it would be too long There was a discussion about the unused bits, and how the stored salt will look. |
|
Sep 25 |
answered | bcrypt: random salt vs computed salt |
|
Sep 24 |
comment |
Why do some sites prevent users from reusing their old passwords? Indeed, there is even the chance that users switch to weaker passwords, because nobody can remember tons of strong passwords. By the way, your friend's system is not worth changing the password, if it used a unique salt, there would be no way telling that the user reused the old password. |
|
Sep 18 |
revised |
Creating multiple secure and easy to remember passwords added 203 characters in body |
|
Sep 18 |
answered | Creating multiple secure and easy to remember passwords |
|
Sep 17 |
comment |
Software that encrypts the data before deleting it There are tools (like eraser), that can wipe all unused disk space (fill it up until it's full), this could be an alternative to wipe the whole disk. |
|
Sep 6 |
comment |
optimal way to salt password? @Terry Chia - Yes i know, i studied it very thoroughly. |
|
Sep 6 |
comment |
optimal way to salt password? @Terry Chia - I didn't recommend to use crypt(), but crypt() is the only native PHP function that implements Bcrypt, there is no function bcrypt() which generates the salt yet. So either you use a library and then it depends on the library, whether the salt is generated and how, or you have to generate it yourself. By the way, i strongly believe that one should understand how it works, and then one should use a well established library. |
|
Sep 6 |
comment |
optimal way to salt password? It depends entirely on the used library, if Bcrypt creates it's own salt. If you use PHP's standard function crypt(), you will have to generate the salt by yourself. |
|
Aug 31 |
comment |
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password? You can always build a rainbow-table, since the number of iterations is not secret, but you need time to do it. When you added a unique salt for each password, the attacker will have to build a rainbow-table for each password (the cost factor doesn't change anything). Building a full rainbow-table for one password doesn't make sense, because you are faster with brute forcing. |
|
Aug 28 |
comment |
Definitely safest password storage scheme? 1) Actually the intention of the salt is not to make dictionary attacks more difficult, the salt is not secret and can be added in a dictionary attack. The salt should prevent using a single rainbowtable to crack all passwords. What you mean is called pepper. 2) Instead of barring users from login, it could be better to slow down the possible attempts. Otherwise it's easy to do some false login attempts, so the user cannot use the service anymore. |
|
Aug 20 |
awarded | Constituent |
|
Aug 14 |
awarded | Caucus |
|
Jul 24 |
comment |
Can anyone provide references for implementing web application self password reset mechanisms properly? I agree with your answer, but why would you include the user-id into the link? If for example this user-id is an 8 character number, these 8 characters are equally easy to guess, as 8 additional random characters in your token. With the random characters you would not expose the user-id though. |
|
Jul 12 |
comment |
How to destroy old credit card? @Thomas - Ah yes, it's a really hard decision then :-) |
|
Jul 12 |
comment |
How to destroy old credit card? @Thomas - Burning it would decrease security - of your house... |
