1,130 reputation
210
bio website xato.net
location Utah
age 44
visits member for 2 years, 4 months
seen Jan 10 at 18:46

IT security consultant and author.


Jul
28
awarded  Nice Answer
Mar
30
awarded  Yearling
Jan
7
comment Windows privileges to escalate?
SeLoadDriverPrivilege and SeSecurityPrivilege are also sensitive. But really a skilled attacker could potentially leverage almost any privilege to at least get closer to admin access.
Jan
7
answered Is data exposed in a CSRF attack?
Jan
7
answered What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?
Jun
3
awarded  Nice Answer
Apr
29
awarded  Nice Answer
Mar
30
awarded  Yearling
Dec
21
comment Is my developer's home-brew password security right or wrong, and why?
Yes you can write your own, but most people who think they are qualified to write their own are not qualified to write their own. It's easy to judge how smart we are, but difficult to judge how dumb we are.
Dec
21
answered Are we concentrating too much on password complexity?
Dec
19
answered Is my developer's home-brew password security right or wrong, and why?
Dec
3
comment Updated list of bad/overused passwords
As for my list at xato.net, I do keep collecting passwords every day. I am currently working on improving my parser but as soon as I finish that I have a few gigabytes of passwords dumps to process. The fact is, however, that the top 1,000 passwords lists have hardly changed much over the last 20 years.
Oct
16
answered How to easily remember lots of different passwords?
Sep
14
comment Identifying an unknown hash
It probably isn't true base64 of md5 because you would see an "=" at the end of each code since 128 bits isn't a multiple of 24 bits (3 octets). It's not likely conversion of any real hash due to the variable length. Also, conversion of hex codes to base64 would only contain the characters ABDEFGIJMNOQRTUVWYZcdghijklmwxyz012345.
Sep
14
comment Identifying an unknown hash
Can you add more examples of the hashes?
Sep
7
answered Scrypt + Bcrypt = cascade hashing
Aug
25
comment Does LastPass' multi-device functionality significantly compromise its security?
Looking in to this a bit more, it appears that the client-side salt is actually SHA256(username+password). Here is a page that reveals quite a bit about how the client-side encryption works: lastpass.com/js/enc.php
Aug
25
revised Does LastPass' multi-device functionality significantly compromise its security?
added 66 characters in body
Aug
25
answered Does LastPass' multi-device functionality significantly compromise its security?
Jul
16
answered Why Disallow Special Characters In a Password?