276 reputation
110
bio website francisco.io
location Valencia, Spain
age 23
visits member for 2 years, 6 months
seen yesterday

Learning for fun and helping others in the way. Knowledge is - or should be - free.

My website: http://francisco.io/

Projects I've put a considerable ammount of effort.

Experiments. Reinventing the wheel for learning and fun.

  • HTML preprocessor: shortening the html you have to write.
  • Matrix in jquery. Everyone should do one.

Other awards


Apr
2
comment Hashing the cookie token for persistent login
The sha256 hash is easier in PHP, however you are right, I'm using already bcrypt so I better stay coherent. The thing with bcrypt (at least for PHP) is that I can change how long it takes for each hash. So I guess now the question would better be, how long it needs to take for each hash. I find 0.5 seconds too high, but I'll ask in another question here, thank you (:
Apr
1
asked Hashing the cookie token for persistent login
Mar
26
comment Is Google overreaching by forcing me to use TLS?
I̶s̶ ̶g̶o̶o̶g̶l̶e̶ ̶E̶v̶i̶l̶ ̶f̶o̶r̶ ̶f̶o̶r̶c̶i̶n̶g̶ ̶y̶o̶u̶ ̶t̶o̶ ̶u̶s̶e̶ ̶H̶T̶M̶L̶?̶ ̶O̶r̶ ̶a̶ ̶b̶r̶o̶w̶s̶e̶r̶?̶ ̶O̶r̶,̶ ̶s̶a̶y̶,̶ ̶t̶h̶e̶ ̶i̶n̶t̶e̶r̶n̶e̶t̶?̶ ̶ U̶n̶f̶o̶r̶t̶u̶n̶a̶t̶e̶l̶y̶ ̶I̶ ̶f̶i̶n̶d̶ ̶t̶h̶a̶t̶ ̶t̶h̶i̶s̶ ̶q̶u̶e̶s̶t̶i̶o̶n̶ ̶d̶o̶e̶s̶n̶'̶t̶ ̶m̶a̶k̶e̶ ̶m̶u̶c̶h̶ ̶s̶e̶n̶s̶e̶.̶.̶. I didn't read your answer. The question didn't make much sense until I realized that you might wonder it and then wanted to answer it, so you had to ask it first (;
Mar
20
comment How does the authentication in the new UK £1 coin work?
@deed02392 I was just going to comment that! However, this seems more like encrypting passwords with the same pass rather than hashing them; break one to break them all.
Mar
6
asked What does hardware full disk encryption imply?
Feb
28
comment Is Adblock (Plus) a security risk?
The link has already been posted by @TobiasKienzler. Also, a hint was the big green sign in the main page that said Open Source.
Feb
28
comment Is Adblock (Plus) a security risk?
Wasn't AdBlock Plus open source? (;
Jan
11
comment Problem with qgankgyefx..vbe virus
Search for "YOUR_PREFERRED_ANTIVIRUS livecd"? LiveCD is a bootable disk (at least in the Linux world), so you can analyze the system while it's off.
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
You cannot just bruteforce bcrypt efficiently, even with GPU...
Jan
11
awarded  Commentator
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
@Ramhound, how would the compromise of the salt and hash allow for bruteforce attack? bcrypt uses hash stretching, which means that each hash takes 0.1s in my system (slow). That means that, even in a 100 times faster system it'd take years to find the original hash of one single password providing it's at least 6 digits with alphanumeric+symbol. There's an excellent Q&A already here
Jan
10
comment Encrypt user data when they log in with Facebook, Gmail, etc
I am looking more for some self-containment system that doesn't require a general verification system, but rather is user-dependent. As I specified in the edit, I want it to be secure even for full read access to the code/database, in a similar fashion as how bcrypt works.
Jan
10
revised Encrypt user data when they log in with Facebook, Gmail, etc
added 362 characters in body
Jan
10
comment Encrypt user data when they log in with Facebook, Gmail, etc
I want to protect user's data from everyone, including admins or/and a thief with the database. I would rather prefer a user-specific salt instead of a pepper, it should make things more secure against a rainbow table on the ids. I don't normally store the user's id from facebook. However, I do store the email. In case of db theft, that'd be known, and a simple email search should yield back the user's id, thus I consider the id as an invalid secret...
Jan
9
revised Encrypt user data when they log in with Facebook, Gmail, etc
deleted 43 characters in body
Jan
9
asked Encrypt user data when they log in with Facebook, Gmail, etc
Nov
23
awarded  Yearling
Nov
22
comment Does bcrypt on top of md5 reduce its security?
@CodesInChaos (about 1st comment), there's a point as it theoretically could already have been leaked. About 2nd, that was the actual point of my question, if there was any actual gain from using only bcrypt(pass) over bcrypt(md5(pass)) (note bcrypt auto-generates a salt, so it's okay not to pass it).
Nov
22
comment Does bcrypt on top of md5 reduce its security?
I consider the correct answer yours, @Adnan, but only after complementing it with the one from CodesInChaos.
Nov
22
accepted Does bcrypt on top of md5 reduce its security?