1,572 reputation
1613
bio website martinstoeckli.ch
location Switzerland
age 42
visits member for 2 years, 9 months
seen 20 hours ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working now mostly with CSharp and use PHP for my spare time project, an internet lost-and-found office.

// Don't tell people that they do wrong, explain the reasons and let them think for themselves.


Dec
18
revised Is SSL more secure than encoding?
edited body
Sep
29
revised PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
added 588 characters in body
Sep
28
revised PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count
edited body
Sep
25
revised Why don't sites implement a system where a wrong password causes a 3 second delay?
edited body
Aug
25
revised Should BCRYPT be used for client-side password hashing
added 338 characters in body
Apr
25
revised How to apply a pepper correctly to bcrypt?
Added note about using encryption instead of a pepper.
Mar
23
revised Why is it not standard practice to run password-based KDF's client-side?
Explained reason why a non-iterated hash can be used.
Mar
21
revised Why is it not standard practice to run password-based KDF's client-side?
deleted 43 characters in body
Mar
21
revised Why is it not standard practice to run password-based KDF's client-side?
added 19 characters in body
Dec
16
revised Can't brute force password cracking somehow be throttled?
Sorry, wrong word
Dec
16
revised Can't brute force password cracking somehow be throttled?
added 65 characters in body
Nov
12
revised Is it useful to protect hashed password with encryption?
added 117 characters in body
Nov
8
revised How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?
added 20 characters in body
Sep
27
revised Secure authentication: partial client-side key stretching… please review/criticize my idea
deleted 5 characters in body
Sep
4
revised Do salts have to be random, or just unique and unknown?
To answer the updated question.
Sep
1
revised Do salts have to be random, or just unique and unknown?
deleted 107 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 5 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
Justification about salt thwarting brute-force attacks.
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 96 characters in body
Aug
29
revised Why is password hashing considered so important?
Thanks TRiG for your corrections (english isn't my native language), but this point is necessary.