Reputation
2,962
Top tag
Next privilege 3,000 Rep.
Cast close & reopen votes
Badges
1 11 19
Newest
 Yearling
Impact
~223k people reached

  • 0 posts edited
  • 0 helpful flags
  • 283 votes cast
2d
comment Could keystroke timing improve security on a password?
The PC keyboard, the notebook keyboard and the smartphone keyboard would definitely create different passwords in my case.
Apr
15
comment when to use encoding over hashing?
When you encode data, you bring it into a form, so a certain system can work properly, it has nothing to do with security. An example is the URL encoding, which can be used to bring an URL into a form, so the browser wont mix up control-characters and characters from the address.
Feb
11
comment How to securely transfer password from a registration page to the database
@MikeOunsworth - Well i changed it to information, maybe that's indeed more understandable.
Feb
11
comment How to securely transfer password from a registration page to the database
@MikeOunsworth - Todays browsers contain a list of root certificates, which are installed together with the browser. Only with those known root certificates, the browser is able to verify a derrived certificate of your website. If the root certificate where not known to the browser before the connection is up, there would be no way to verify the certificate, because you do not have a secure connection (that's why self signed certificates are not trusted).
Nov
18
comment Is it OK to reuse the same SALT key across multiple deployments?
It seems that you are talking about encryption (two way), then you need an IV not a salt. Both salt and IV should be unique and should not be reused.
Nov
13
comment Is it possible to be a hacker without being a criminal?
Maybe you could apply for a job at the NSA?
Aug
14
comment Hashing Algorithms Costs vs Sleep
Your first point is incorrect, if the hash algorithm is slow, this will thwart offline brute-force attacks. The slowness has to come from the necessary cpu time and not from a sleep() that can be circumvented though. That's why one should use a slow hash algorithm with a cost factor.
May
22
comment Please help verify my understanding of Domain Validation (DV) SSL Certificate
@Pacerier - The prices vary very much and are dependend of your country. I can only speak for switzerland, there you can buy a domain validated certificate for about 50$ per year, and you get an ev certificate for 300-1200$ per year.
May
11
comment Store password using sha1
@LoganWayne - I assume that your question targets the password_hash() function. Yes you can either use no parameters, or a cost factor alone, it is not a good idea to pass a salt though, because the function already generates a safe one. Added an example in the answer.
May
11
comment Store password using sha1
@LoganWayne - Yes that is what i would recommend, it is implemented in fast native code in PHP 5.5 and later, but there also exists a compatibility pack for earlier versions.
May
11
comment Store password using sha1
@LoganWayne - I would suggest to use the password_hash() function instead, it generates a BCrypt hash which is difficult to use on GPUs. And btw. it is also much easier, it takes care of generating a safe salt and is future proof.
Apr
27
comment Should password reset tokens be hashed when stored in a database?
@IanWarburton - I do not have a facebook account, so i cannot verify how they solved the password reset function.
Apr
27
comment Should password reset tokens be hashed when stored in a database?
@IanWarburton - A six digit number has not nearly enough entropy to be used as a token, so it is not safe to store its hash in the database. A salt won't help neither, because the salt is known and a million possibilities can be brute-forced in a fraction of a second. If you take the code as a password, you would have to use a slow salted key-derivation function at least.
Apr
27
comment Should password reset tokens be hashed when stored in a database?
@IanWarburton - No, hashing is a one-way operation and doesn't need a secret key. You probably think of an encryption algorithm which needs a key to decrypt the string. You could have a look at my tutorial about safely storing passwords to get more in-depth information.
Apr
27
comment Should password reset tokens be hashed when stored in a database?
If an attacker has read access to the database (SQL-injection), he could request a reset for any account he wants, even for admin accounts. Because he can see the new generated token, he could take over this account.
Apr
26
comment Should password reset tokens be hashed when stored in a database?
@IanWarburton - If your token has enough entropy, lets say 20 random characters 0-9 a-z A-Z, then you can calculate an unsalted fast hash (e.g. SHA-256 or SHA-512) and store it. This is safe, because it is not possible to successfully brute-force such strong "passwords". Salting is done, because passwords choosen by people are often relatively weak, because they have to be remembered.
Mar
19
comment Is it possible to perform a MITM attack with a smartphone?
Moxie Marlinspike demonstrated something similar with his notebook, and people did connect to his hotspot, see the SSL-strip demo.
Mar
8
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
@RobW - This is good news, thanks for the info. It seems that key derivation functions are not widely supported yet, but anyway it looks promising.
Mar
4
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
@Eckster - There is no reason this cannot be done on optimized hardware. Wellknown password cracker tools like hashcat support brute-forcing SHA* on GPUs, not to mention dedicated NSA hardware.
Mar
4
comment Why do major sites(Facebook, Google, etc) still send passwords unhashed?
@Eckster - I doubt it, because this is a race between a relatively slow interpreted script language, and optimized hardware like GPUs or even dedicated hardware, which can do calculations parallel.