1,487 reputation
1613
bio website martinstoeckli.ch
location Switzerland
age 41
visits member for 2 years, 5 months
seen 33 mins ago

I belong to the lucky people, who can combine job and hobby, in my case writing software. Coming from the Delphi world, i'm working more and more with CSharp and use PHP for my spare time project, an internet lost-and-found office.

// Don't tell people not do something, explain the reasons and let them think for themselves.


Aug
25
revised Should BCRYPT be used for client-side password hashing
added 338 characters in body
Apr
25
revised How to apply a pepper correctly to bcrypt?
Added note about using encryption instead of a pepper.
Mar
23
revised Why is it not standard practice to run password-based KDF's client-side?
Explained reason why a non-iterated hash can be used.
Mar
21
revised Why is it not standard practice to run password-based KDF's client-side?
deleted 43 characters in body
Mar
21
revised Why is it not standard practice to run password-based KDF's client-side?
added 19 characters in body
Dec
16
revised Can't brute force password cracking somehow be throttled?
Sorry, wrong word
Dec
16
revised Can't brute force password cracking somehow be throttled?
added 65 characters in body
Nov
12
revised Is it useful to protect hashed password with encryption?
added 117 characters in body
Nov
8
revised How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?
added 20 characters in body
Sep
27
revised Secure authentication: partial client-side key stretching… please review/criticize my idea
deleted 5 characters in body
Sep
4
revised Do salts have to be random, or just unique and unknown?
To answer the updated question.
Sep
1
revised Do salts have to be random, or just unique and unknown?
deleted 107 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 5 characters in body
Sep
1
revised Do salts have to be random, or just unique and unknown?
Justification about salt thwarting brute-force attacks.
Sep
1
revised Do salts have to be random, or just unique and unknown?
added 96 characters in body
Aug
29
revised Why is password hashing considered so important?
Thanks TRiG for your corrections (english isn't my native language), but this point is necessary.
Aug
17
revised What are the benefits and drawbacks of emailing a user a login token/link?
added 203 characters in body
Mar
22
revised When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?
added 395 characters in body
Mar
11
revised How can I explain SQL injection without technical jargon?
Removed unnecessary stuff.
Feb
8
revised How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
added 104 characters in body