849 reputation
1124
bio website
location
age
visits member for 3 years, 1 month
seen May 26 at 8:18

Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz those will be stored in DB as user-specific salt
Apr
30
comment Stripping / appending characters from user password before hashing to conceal it forever?
@DavidSchwartz The hashes are usable. I am not sure if I get your question but if you are asking how to authenticate on login (since passwords have been stripped), the system just repeats the process on login. It strips predefined character positions from the password and appends the previously added salt.
Apr
29
comment Stripping / appending characters from user password before hashing to conceal it forever?
I fully agree that the cost of this is the ability to somehow "regex" the login. But given the system has already been compromised, this implementation does add an extra layer of "slowness" to decrypt which is the goal of password hashing right?
Apr
29
comment Stripping / appending characters from user password before hashing to conceal it forever?
The hacker's intention is NOT to login to the same system anymore. He already have the whole DB, no need to login to get any other info as he already have everything needs including the password protected info. The important thing here is the original password is still concealed forever. The benefit is, the password ecrt12!@#$%^&* or pecret129 will not work with other systems like Facebook/banking/email.
Apr
29
asked Stripping / appending characters from user password before hashing to conceal it forever?
Apr
28
accepted Implementing 2-step verification via email for web apps?
Apr
28
accepted Can key files be brute-forced like passwords?
Apr
27
asked Can key files be brute-forced like passwords?
Apr
27
comment Bank account number and account holder in check exposed?
I agree that this system somewhat works but sometime ago my Paypal was hacked simply because the attacker knew my bank account and a bunch of other personal details. He never knew my password but he pretended to be me and called/emailed Paypal. Even though Paypal never revealed how the hacker got in, I suspect Paypal verified his calls and the attacker presented valid information and that includes my bank account. Lesson learned here is keep your bank account secret or at least use a different bank account for Paypal.
Apr
27
comment Bank account number and account holder in check exposed?
@Ramhound Sometime ago, my Paypal account was hacked because my name and my bank account was known by someone else pretending to be me. He made a call/emailed Paypal pretending to be me, that's how he got in. I was able to reverse everything but still it caused me time and money. That's why I think bank accounts are very sensitive information.
Apr
27
awarded  Commentator
Apr
27
comment Bank account number and account holder in check exposed?
@DavidSchwartz That would really be nice to have.
Apr
27
comment Implementing 2-step verification via email for web apps?
I see. You are right email will be a different channel. Do you have any suggestions on how we can protect sensitive emails which contain verification codes and passwords?
Apr
26
comment Implementing 2-step verification via email for web apps?
So you mean to say even I install SSL for the whole site, an eavesdropper can still intercept it? Or only to certain users using public WIFI? BTW what do you mean "CA"?
Apr
24
comment Bank account number and account holder in check exposed?
@FiascoLabs Yes that would best practices, just like using different passwords in your Email and your Facebook/Stackexchange/Etc. It will prevent a signature copier from stealing all your bank accounts since they're all different signatures.
Apr
24
comment Bank account number and account holder in check exposed?
@FiascoLabs As mentioned there are some checks that has printed name of the holder by default. I think that's unnecessary. Actually even the account holder's signature is a security risk if it's the same signature you use with another savings account (one that's not meant for issuing checks, usually with a lot more money on it). IMO you should have two different signatures for checking account (public) and savings account (only you and banker knows).
Apr
24
awarded  Supporter
Apr
24
awarded  Scholar
Apr
24
accepted Why do DDoS attacks cost a fortune to stop?
Apr
24
comment Bank account number and account holder in check exposed?
@Ramhound You are right. So I guess it's safe to say the whole banking system is up for a revamp.