276 reputation
110
bio website francisco.io
location Valencia, Spain
age 23
visits member for 2 years, 6 months
seen 9 hours ago

Learning for fun and helping others in the way. Knowledge is - or should be - free.

My website: http://francisco.io/

Projects I've put a considerable ammount of effort.

Experiments. Reinventing the wheel for learning and fun.

  • HTML preprocessor: shortening the html you have to write.
  • Matrix in jquery. Everyone should do one.

Other awards


Oct
16
comment How do web email clients store my passwords from other providers?
That was basically the question, what method/way do they use to encrypt/decrypt them...
Oct
16
comment How do web email clients store my passwords from other providers?
Hotmail needs the popbox login, which you enter only one time, and stores this permanently on its own servers This is exactly what I meant to say. How do they store my credentials securely on its own server? That was my question, I'm sorry for making it confusing
Sep
19
comment Why is it a security problem not to update one's browser?
Because otherwise you can find front-end developers hunting you down with a keyboard for using IE6
Sep
13
comment Is my custom password hashing algorithm insecure?
TL;DR yes, it is insecure. Don't roll your own hashing algorithm
Jul
16
comment How do web email clients store my passwords from other providers?
I'm just saying that there's the possibility that the master passwords is derived from my main password and stored in cookies; so it can be retrieved from cookies OR when I log in.
Jul
10
comment Should I get an antivirus for my Mac?
References for [...] there were historically so few viruses around for Mac is because their market share was so small. please? I had understood that it had to do more with, historically, windows being run as admin and *nix systems not being root by default.
Jun
22
comment How to store passwords securely in my server?
@eric I haven't, I've searched for previous questions in security.SE since it seems like the good place to ask about security. Thanks for the link.
Jun
22
comment How to store passwords securely in my server?
@eric, no, they don't. However, this is a slightly broader question; it's not about supporting my uni's email, it's about supporting imap securely.
Jun
17
comment Allowing users to input a safe subset of HTML
What would happen if I only wrote </body>? This should give you an idea of what can go wrong. For the images/link, you can put them in a query and manually check them (before or after allowing for public viewing).
Apr
10
comment Encrypt user data when they log in with Facebook, Gmail, etc
@JohnDeters, your comment could be perfectly the accepted answer so future visitors (as myself) have a clear answer, if you want.
Apr
2
comment Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
+1 for the scheme I describe above is homemade crypto, and that's bad. I can get away with it because I am totally awesome, but this cannot be promoted on a general basis
Apr
2
comment Hashing the cookie token for persistent login
The sha256 hash is easier in PHP, however you are right, I'm using already bcrypt so I better stay coherent. The thing with bcrypt (at least for PHP) is that I can change how long it takes for each hash. So I guess now the question would better be, how long it needs to take for each hash. I find 0.5 seconds too high, but I'll ask in another question here, thank you (:
Mar
26
comment Is Google overreaching by forcing me to use TLS?
I̶s̶ ̶g̶o̶o̶g̶l̶e̶ ̶E̶v̶i̶l̶ ̶f̶o̶r̶ ̶f̶o̶r̶c̶i̶n̶g̶ ̶y̶o̶u̶ ̶t̶o̶ ̶u̶s̶e̶ ̶H̶T̶M̶L̶?̶ ̶O̶r̶ ̶a̶ ̶b̶r̶o̶w̶s̶e̶r̶?̶ ̶O̶r̶,̶ ̶s̶a̶y̶,̶ ̶t̶h̶e̶ ̶i̶n̶t̶e̶r̶n̶e̶t̶?̶ ̶ U̶n̶f̶o̶r̶t̶u̶n̶a̶t̶e̶l̶y̶ ̶I̶ ̶f̶i̶n̶d̶ ̶t̶h̶a̶t̶ ̶t̶h̶i̶s̶ ̶q̶u̶e̶s̶t̶i̶o̶n̶ ̶d̶o̶e̶s̶n̶'̶t̶ ̶m̶a̶k̶e̶ ̶m̶u̶c̶h̶ ̶s̶e̶n̶s̶e̶.̶.̶. I didn't read your answer. The question didn't make much sense until I realized that you might wonder it and then wanted to answer it, so you had to ask it first (;
Mar
20
comment How does the authentication in the new UK £1 coin work?
@deed02392 I was just going to comment that! However, this seems more like encrypting passwords with the same pass rather than hashing them; break one to break them all.
Feb
28
comment Is Adblock (Plus) a security risk?
The link has already been posted by @TobiasKienzler. Also, a hint was the big green sign in the main page that said Open Source.
Feb
28
comment Is Adblock (Plus) a security risk?
Wasn't AdBlock Plus open source? (;
Jan
11
comment Problem with qgankgyefx..vbe virus
Search for "YOUR_PREFERRED_ANTIVIRUS livecd"? LiveCD is a bootable disk (at least in the Linux world), so you can analyze the system while it's off.
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
You cannot just bruteforce bcrypt efficiently, even with GPU...
Jan
11
comment Encrypt user data when they log in with Facebook, Gmail, etc
@Ramhound, how would the compromise of the salt and hash allow for bruteforce attack? bcrypt uses hash stretching, which means that each hash takes 0.1s in my system (slow). That means that, even in a 100 times faster system it'd take years to find the original hash of one single password providing it's at least 6 digits with alphanumeric+symbol. There's an excellent Q&A already here
Jan
10
comment Encrypt user data when they log in with Facebook, Gmail, etc
I am looking more for some self-containment system that doesn't require a general verification system, but rather is user-dependent. As I specified in the edit, I want it to be secure even for full read access to the code/database, in a similar fashion as how bcrypt works.