Reputation
6,564
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
4 13 46
Newest
 Nice Answer
Impact
~325k people reached

Jul
13
comment Infection risk downloading one’s own file from Gmail
@Edwardo yeah there are a number of things you can do. The easiest would be to use unix tools like find, md5sum and diff.
Jul
13
awarded  Nice Answer
Jul
13
answered One time password over SMS - exposing the Authentication Server to the internet
Jul
13
answered Infection risk downloading one’s own file from Gmail
Jul
12
awarded  Civic Duty
Jul
11
answered What are the advantages of multi-level authentication?
Jul
11
comment Storing session key for iOS app
I'm not an iOS developer, but session keys should not be stored anywhere persistent. Keychains are usually persistent databases so would be unsuitable. A session key lives in memory only.
Jul
11
comment Taking password letters not whole one, is this secure?
An HSM is able to store a private key, perform decryptions internally, and even perform some arbitrary computations. All without ever revealing the private key or the plaintext. The database stores the passwords, encrypted under a public key. To check a password, you feed the encrypted version and the letters to the HSM, and it spits back a yes or a no. This process can be made to be slow also. The point is, nobody ever knows the plaintext password - nobody ever even knows the private key!
Jul
11
comment Taking password letters not whole one, is this secure?
So the SHA family is designed to be fast. They are great for indexing and lookups for that reason. Password hashing needs to be slow, like maxed-out CPU for 3 seconds kind of slow. This makes brute-forcing prohibitively expensive even if the attacker has access to a full database of hashes. Password hashing should be done with something like bcrypt, PBKDF2 or scrypt.
Jul
11
comment Taking password letters not whole one, is this secure?
SHA-256 and SHA512 are no better than MD5, and systems like this are unlikely to be implemented without an HSM. If they care enough about security to implement something like this, then they have probably researched how to do it (we hope).
Jul
11
comment Taking password letters not whole one, is this secure?
@ewanm89 I'm not sure I follow you. Neither "crypto" or HSM's "stop keylogging" they provide storage of cryptographic material. This is useful in this case because it allows decryption of the user's passwords within the HSM under a private key that is never known.
Jul
11
comment Taking password letters not whole one, is this secure?
@ewanm89 there are various technologies in place to prevent forensic reverse engineering of secure hardware, generally including zeroing secrets when a tamper attempt is detected. @BlackFire27 MD5 is a secure hash algorithm, and is designed to be fast. It has no place as a password storage format. Instead, one should opt for a slow mechanism such as bcrypt, or scrypt if you are worried about GPU attacks.
Jul
11
comment Taking password letters not whole one, is this secure?
@PeeHaa there is a trade-off, as always. Now you only have to 'brute-force a subset of the password, but in reality, keyloggers are a much bigger threat, which is what this mechanism is designed to counter.
Jul
11
comment Taking password letters not whole one, is this secure?
The passwords are stored in an HSM, not in a reversible software format. See here for an explanation of why you can't do it in software alone.
Jul
11
comment Taking password letters not whole one, is this secure?
@PeeHaa this is perfectly reasonable practice. The only problem here is a shoulder-surfer gets the password length. This is very common practice for bank web portals around the world.
Jul
10
answered Is + as an alternative to %20 an attack vector?
Jul
7
comment What are ports?
While you're in Austin, head to Jackalope on Trinity and 6th, order the pork-shoulder burger, thank me when you get back.
Jul
3
answered How risky is connecting to a hidden wireless network?
Jun
14
answered Does Gmail 2-factor auth increase security on smartphones?
Jun
14
comment Files deleted by some Employee . How to find what time it happened and whether done from another computer on network?
I'm curious as to why you say recovering files from an ext filesystem is harder than from NTFS?