Thomas

375 reputation

bio	website
	location
	age
visits	member for	1 year, 2 months
	seen	22 hours ago
stats	profile views	25

	375 reputation	bio	website		visits	member for	1 year, 2 months
29 badges		location			seen	22 hours ago

summary answers questions tags badges favorites bounties reputation activity

73 Actions

suggestions reviews revisions comments badges posts accepts all

May 9	comment	Is salting a hash really as secure as common knowledge implies? @ThomasAndreèLian Not for some randomly generated salt, no.
Mar 12	awarded	Yearling
Mar 5	comment	Account lockout with human interaction required to unlock The help desk is not 24/7. If this happens at night, you are screwed.
Mar 5	accepted	Account lockout with human interaction required to unlock
Mar 4	comment	Account lockout with human interaction required to unlock As for the accounts themselves, they are not particularly valuable in and of themselves, but since you need an account to access many of the online services, a compromise could cause major disruption.
Mar 4	comment	Account lockout with human interaction required to unlock No, it simply says "ERROR: The username and/or password you entered is not correct." in either case.
Mar 4	comment	Account lockout with human interaction required to unlock The username is a simple first name/surname mashup, and I believe I have access to enrolment lists for the courses I'm attending, so I think I could derive at least two hundred usernames without too much difficulty. And even then it would not be infeasible to hang around the library and snoop on people's username as they log on. Not sure about an external attacker, but if the system is as fragile as I fear it is, an attacker with inside information could certainly do a lot of damage.
Mar 4	asked	Account lockout with human interaction required to unlock
Feb 28	comment	What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed? Personally when looking for raw entropy, I find hexadecimal digits easiest to remember. Lower than that and the password gets too long, and beyond that there are too many symbols to remember. I use a 20-character hexadecimal passphrase as my master passphrase (80 bits of entropy). One can easily remember up to 128 bits, but not too many of them, which is why some form of password derivation is often desired.
Jan 12	comment	Passing generated keys to another process What is your threat model?
Jan 12	comment	Passing generated keys to another process Well, as far as absolute security goes, I'd say process communication would be safest, followed by the socket method (which is really a form of IPC). But for such considerations to be made, you'd have to assume the attacker has complete access to the system, and at that point he could just read your process's memory to get the key anyhow.
Dec 28	comment	Why Do we Need CAPTCHA? In what case we should use it? Or.. you know.. cheaply pay people in third world countries to solve captchas served by proxy.
Dec 28	comment	Is possible to know if increased marketshare means more viruses? In my humble opinion: 1, perpetuated by 2. But just my intuition.
Dec 22	comment	Future proof encryption possible in theory? Check out Tahoe-LAFS, they've apparently done some work on 100-year cryptography.
Dec 21	comment	If someone asks to borrow your phone to make a call, what could they do? Bullet point #1: I have found my true calling.
Dec 19	comment	Gold Standard for password hashing I should mention it here again, the 2^61 collision attack on SHA-1 (and even the 2^80 birthday attack) is irrelevant to password hashing..
Dec 18	comment	Is my developer's home-brew password security right or wrong, and why? @jmoreno In general, security by obscurity is perceived as a crutch for poor cryptography practices, and it often is. That doesn't mean it doesn't have value - it does have its uses, but in this situation it is not warranted.
Dec 18	comment	Is my developer's home-brew password security right or wrong, and why? @jmoreno Still doesn't justify his useless scheme.
Dec 16	comment	How to authenticate a salted password? Just thought I should mention the obvious, in case somebody gets the wrong idea: a 32-bit hash is not secure.
Dec 14	comment	Is there value in storing passwords in their own table with encrypted or hashed keys? And where do you propose the secret key be stored? If it's on the server, why should the hypothetical "hacker" not be able to get a hold of it if it can access the password and user tables?