774 reputation
1020
bio website
location
age
visits member for 2 years, 7 months
seen Sep 14 at 5:40

Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@Polynomial I guess it's safe to say wrapping scrypt or bcrypt or pbkdf2 to a fixed length hash weakens them?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Isn't this method quite collision prone?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
So I guess the only problem of this is collision. What if I use SHA256 instead for a wrapper? For example, which is stronger in this case: A PBKDF2 hash with 64 bytes output... or a PBKDF2 hash with 256 bytes output then wrapped with SHA256 for a 64 bytes final output?
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
@TerryChia Yes that's what I meant.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
If they crack the md5 hash what they get is another hash made with bcrypt for example.
Aug
9
asked Is it okay to wrap a cryptographic hash with MD5 for storage?
Aug
8
accepted Securely tell the user his password in new WHM/Cpanel account creation?
Aug
3
accepted Are my credentials unsafe if I am already logged-in before connecting to a public network?
Aug
3
asked Securely tell the user his password in new WHM/Cpanel account creation?
Aug
3
comment What was done to gain a list of home directory accounts?
@schroeder I see but aren't those commands accessible to root only? Do you think a file hosted on a shared cpanel account can actually run this?
Aug
2
asked Can /etc/passwd file be accessed on a cpanel shared hosting account?
Aug
2
comment What was done to gain a list of home directory accounts?
@symcbean Do you mean a PHP or Perl script can get all the data as presented in the text file?
Aug
2
comment What was done to gain a list of home directory accounts?
The video you posted is not WHM/Cpanel, that is a different product called WHMCS.
Aug
2
asked What was done to gain a list of home directory accounts?
Jun
19
comment Are my credentials unsafe if I am already logged-in before connecting to a public network?
Is HTTPS is still considered safe? I just read about "SSL Strip" and it seems SSL is no longer safe.
Jun
18
asked Are my credentials unsafe if I am already logged-in before connecting to a public network?
Jun
16
asked What's the idea behind requiring users to change password periodically?
Jun
16
awarded  Critic
Jun
3
comment Should passwords be revealed in error message?
@D.W. They marked it private, not sure why.
Jun
2
awarded  Nice Question