Reputation
981
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 15 30
Newest
 Yearling
Impact
~80k people reached

  • 0 posts edited
  • 0 helpful flags
  • 25 votes cast
May
30
comment Should passwords be revealed in error message?
Other examples: stackoverflow.com/questions/7924935/…
May
30
comment Should passwords be revealed in error message?
@symcbean heavy traffic is another probable cause of this in a production server. Example: stackoverflow.com/questions/6455018/…
May
30
comment Should passwords be revealed in error message?
I think we all agree this is unacceptable. The question now is how can we persuade them to do something about it? The conversation I pasted above was already my attempt to suggest this change. It was done in php.net's bug/suggestion area and as you've read in their reply, they don't seem to take it seriously. Anybody knows other ways to put this message across?
May
29
asked Should passwords be revealed in error message?
May
15
accepted Is Android's Password Screen Lock Enough Data Theft Protection?
May
10
comment Is Android's Password Screen Lock Enough Data Theft Protection?
Also, in hook it up to a pc and log in to your google account. This unlocks the phone. But that doesn't mean you can't access the files on the phone. What do you mean you can't access the files since you managed to unlock it already?
May
10
comment Is Android's Password Screen Lock Enough Data Theft Protection?
Just to clarify, if USB debugging is on, a thief can gain access even if he don't know the password?
May
10
comment Is Android's Password Screen Lock Enough Data Theft Protection?
@cx42net Good point, I actually checked my phone and there was indeed some clues.
May
10
asked Is Android's Password Screen Lock Enough Data Theft Protection?
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@GrahamLee Nope, it fact I agree specially with your point of regex. It's just that I am not sure what else DavidSchwartz is trying to prove (no offense). He argues about arbitrary passwords it's pretty obvious that "secrt12" is "secret12". or Consider if the password is "foo,bar". That's harder to guess than "foobar" If anything, that doesn't make any critical argument. Basically he just repeats what you already said.
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz in my example it's not secrt12 it was ecrt12 and that is just an "example"... of course the actual password could've been @#%!@^(!&@&*! rather than foo,bar.
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz Kindly enlighten why you don't like complexity where as we all know the more slower, the more complex, the longer an attacker will take to reverse hashes.
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz The number salt is not the point of this question but modification of original password before hashing. I just added salt to mix like mentioned: "granting all common practices were used like salt, etc"... just to prevent other people from saying "you need salt, etc etc."
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz There effectively 3 salts total. One of which is with $modifiedpassword this is where random characters are added. The other two "salts" are $uniquesalt and $systempepper
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz those will be stored in DB as user-specific salt
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz The hashes are usable. I am not sure if I get your question but if you are asking how to authenticate on login (since passwords have been stripped), the system just repeats the process on login. It strips predefined character positions from the password and appends the previously added salt.
Apr
29
comment Stripping / appending characters from user password before hashing to conceal it forever?
I fully agree that the cost of this is the ability to somehow "regex" the login. But given the system has already been compromised, this implementation does add an extra layer of "slowness" to decrypt which is the goal of password hashing right?
Apr
29
comment Stripping / appending characters from user password before hashing to conceal it forever?
The hacker's intention is NOT to login to the same system anymore. He already have the whole DB, no need to login to get any other info as he already have everything needs including the password protected info. The important thing here is the original password is still concealed forever. The benefit is, the password ecrt12!@#$%^&* or pecret129 will not work with other systems like Facebook/banking/email.
Apr
29
asked Stripping / appending characters from user password before hashing to conceal it forever?
Apr
28
accepted Implementing 2-step verification via email for web apps?