1,282 reputation
415
bio website bradconte.com
location Texas, USA
age 27
visits member for 2 years, 4 months
seen Jul 21 at 23:07

I'm a software engineer with a background in computer science and mathematics. I love cryptography, math, and Linux.

More about me on my website: http://bradconte.com/about.


Apr
2
awarded  Yearling
Jul
28
awarded  Informed
Jun
24
awarded  Nice Answer
Jun
5
comment Password and username used to connect to database in source code
This really touches on the subject of security best practices. You can make many arguments for why an approach is secure as it's functionally equivalent, but security best-practice, approach. But the problem is that circumstances change and many assumptions turn out to be incorrect. Security best practices try to provide resilience to unanticipated circumstances and flawed assumptions, and those are often to blame for security flaws. (Sorry for the long comment, but your follow-up question is a full question in its own right.)
Jun
5
comment Password and username used to connect to database in source code
Yes and no. Since user input is not practical for the majority of server applications, it is considered an acceptable risk to store credentials on disk (with precautions). It is assumed that anyone who can get access to this location will compromise the credentials. Technically you could treat all source files like the config file and have equivalent security, but this has practical drawbacks. Most source code is versioned offsite - is that place safe for credentials? What if you get help debugging code, can the credentials be shown? Can you remember which files have the credentials? Etc.
Jun
5
answered Password and username used to connect to database in source code
Apr
2
awarded  Yearling
Feb
26
comment Key length and hash function in PBKDF2
Worth noting for clarity on the quoted paragraph: The first part refers to output length of output used as an encryption key. But the latter part of the paragraph refers to output lengths of output used as a hash of the original password.
Feb
26
revised Key length and hash function in PBKDF2
edited tags
Feb
20
revised Ethernet security
Proper list style.
Feb
20
revised Ethernet security
Rewording.
Feb
20
answered Ethernet security
Feb
15
revised Can URLs be sniffed when using SSL?
edited tags
Feb
15
reviewed No Action Needed Create a unterminable process in Windows
Feb
15
reviewed Reviewed An attack from my Employer
Feb
12
revised Is it reasonable to prevent timing attacks by using fixed processing time
edited tags
Feb
12
answered How isolated are 2 operating systems on 1 harddisk?
Feb
12
answered Is it reasonable to prevent timing attacks by using fixed processing time
Feb
11
revised Why is it even possible to forge sender header in e-mail?
Typos in the main question made it difficult to parse.
Feb
11
answered Why is it even possible to forge sender header in e-mail?