meta user
network profile
|
Apr 29 |
awarded | Nice Answer |
|
Mar 30 |
awarded | Yearling |
|
Dec 21 |
comment |
Is my developer's home-brew password security right or wrong, and why? Yes you can write your own, but most people who think they are qualified to write their own are not qualified to write their own. It's easy to judge how smart we are, but difficult to judge how dumb we are. |
|
Dec 21 |
answered | Are we concentrating too much on password complexity? |
|
Dec 19 |
answered | Is my developer's home-brew password security right or wrong, and why? |
|
Dec 3 |
comment |
Updated list of bad/overused passwords As for my list at xato.net, I do keep collecting passwords every day. I am currently working on improving my parser but as soon as I finish that I have a few gigabytes of passwords dumps to process. The fact is, however, that the top 1,000 passwords lists have hardly changed much over the last 20 years. |
|
Oct 16 |
answered | How to easily remember lots of different passwords? |
|
Sep 14 |
comment |
Identifying an unknown hash It probably isn't true base64 of md5 because you would see an "=" at the end of each code since 128 bits isn't a multiple of 24 bits (3 octets). It's not likely conversion of any real hash due to the variable length. Also, conversion of hex codes to base64 would only contain the characters ABDEFGIJMNOQRTUVWYZcdghijklmwxyz012345. |
|
Sep 14 |
comment |
Identifying an unknown hash Can you add more examples of the hashes? |
|
Sep 7 |
answered | Scrypt + Bcrypt = cascade hashing |
|
Aug 25 |
comment |
Does LastPass' multi-device functionality significantly compromise its security? Looking in to this a bit more, it appears that the client-side salt is actually SHA256(username+password). Here is a page that reveals quite a bit about how the client-side encryption works: lastpass.com/js/enc.php |
|
Aug 25 |
revised |
Does LastPass' multi-device functionality significantly compromise its security? added 66 characters in body |
|
Aug 25 |
answered | Does LastPass' multi-device functionality significantly compromise its security? |
|
Jul 16 |
answered | Why Not Allow Special Characters In a Password? |
|
Jul 7 |
comment |
In what situations are web services required to protect confidentiality of user information? I can't imagine any situation where a web service would not be required to protect the confidentiality of user information. |
|
Jul 6 |
answered | Knowing Hash Algorithm from Hashed String |
|
Jul 5 |
answered | Are there any anonymous OpenID providers similar to Gawker's “burner”? |
|
Jun 27 |
comment |
Using passwords made of words Another article: Analyzing the XKCD Passphrase Comic |
|
Jun 19 |
comment |
Storing passwords online using Gmail documents Password best practices are still important. |
|
Jun 18 |
comment |
Could this login form be “hacked” to allow access? It wouldn't hurt to also make sure the query returns exactly one record. |
