meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year |
| seen | May 16 at 16:39 | |
| stats | profile views | 33 |
|
Jun 18 |
asked | Are my credentials unsafe if I am already logged-in before connecting to a public network? |
|
Jun 16 |
asked | What's the idea behind requiring users to change password periodically? |
|
Jun 16 |
awarded | Critic |
|
Jun 3 |
comment |
Should passwords be revealed in error message? @D.W. They marked it private, not sure why. |
|
Jun 2 |
awarded | Nice Question |
|
May 30 |
comment |
Should passwords be revealed in error message? stackoverflow.com/questions/8619253/… |
|
May 30 |
comment |
Should passwords be revealed in error message? Other examples: stackoverflow.com/questions/7924935/… |
|
May 30 |
comment |
Should passwords be revealed in error message? @symcbean heavy traffic is another probable cause of this in a production server. Example: stackoverflow.com/questions/6455018/… |
|
May 30 |
comment |
Should passwords be revealed in error message? I think we all agree this is unacceptable. The question now is how can we persuade them to do something about it? The conversation I pasted above was already my attempt to suggest this change. It was done in php.net's bug/suggestion area and as you've read in their reply, they don't seem to take it seriously. Anybody knows other ways to put this message across? |
|
May 29 |
asked | Should passwords be revealed in error message? |
|
May 15 |
accepted | Is Android's Password Screen Lock Enough Data Theft Protection? |
|
May 10 |
comment |
Is Android's Password Screen Lock Enough Data Theft Protection? Also, in hook it up to a pc and log in to your google account. This unlocks the phone. But that doesn't mean you can't access the files on the phone. What do you mean you can't access the files since you managed to unlock it already? |
|
May 10 |
comment |
Is Android's Password Screen Lock Enough Data Theft Protection? Just to clarify, if USB debugging is on, a thief can gain access even if he don't know the password? |
|
May 10 |
comment |
Is Android's Password Screen Lock Enough Data Theft Protection? @cx42net Good point, I actually checked my phone and there was indeed some clues. |
|
May 10 |
asked | Is Android's Password Screen Lock Enough Data Theft Protection? |
|
Apr 30 |
comment |
Stripping / appending characters from user password before hashing to conceal it forever? @GrahamLee Nope, it fact I agree specially with your point of regex. It's just that I am not sure what else DavidSchwartz is trying to prove (no offense). He argues about arbitrary passwords it's pretty obvious that "secrt12" is "secret12". or Consider if the password is "foo,bar". That's harder to guess than "foobar" If anything, that doesn't make any critical argument. Basically he just repeats what you already said. |
|
Apr 30 |
comment |
Stripping / appending characters from user password before hashing to conceal it forever? @DavidSchwartz in my example it's not secrt12 it was ecrt12 and that is just an "example"... of course the actual password could've been @#%!@^(!&@&*! rather than foo,bar. |
|
Apr 30 |
comment |
Stripping / appending characters from user password before hashing to conceal it forever? @DavidSchwartz Kindly enlighten why you don't like complexity where as we all know the more slower, the more complex, the longer an attacker will take to reverse hashes. |
|
Apr 30 |
comment |
Stripping / appending characters from user password before hashing to conceal it forever? @DavidSchwartz The number salt is not the point of this question but modification of original password before hashing. I just added salt to mix like mentioned: "granting all common practices were used like salt, etc"... just to prevent other people from saying "you need salt, etc etc." |
|
Apr 30 |
comment |
Stripping / appending characters from user password before hashing to conceal it forever? @DavidSchwartz There effectively 3 salts total. One of which is with $modifiedpassword this is where random characters are added. The other two "salts" are $uniquesalt and $systempepper |
