6,071 reputation
41142
bio website adranos.com
location
age
visits member for 2 years, 7 months
seen Feb 13 at 14:40

@TildalWave said having a sig would encourage more people to view my profile. Also beer.


Jul
11
comment Storing session key for iOS app
I'm not an iOS developer, but session keys should not be stored anywhere persistent. Keychains are usually persistent databases so would be unsuitable. A session key lives in memory only.
Jul
11
comment Taking password letters not whole one, is this secure?
An HSM is able to store a private key, perform decryptions internally, and even perform some arbitrary computations. All without ever revealing the private key or the plaintext. The database stores the passwords, encrypted under a public key. To check a password, you feed the encrypted version and the letters to the HSM, and it spits back a yes or a no. This process can be made to be slow also. The point is, nobody ever knows the plaintext password - nobody ever even knows the private key!
Jul
11
comment Taking password letters not whole one, is this secure?
So the SHA family is designed to be fast. They are great for indexing and lookups for that reason. Password hashing needs to be slow, like maxed-out CPU for 3 seconds kind of slow. This makes brute-forcing prohibitively expensive even if the attacker has access to a full database of hashes. Password hashing should be done with something like bcrypt, PBKDF2 or scrypt.
Jul
11
comment Taking password letters not whole one, is this secure?
SHA-256 and SHA512 are no better than MD5, and systems like this are unlikely to be implemented without an HSM. If they care enough about security to implement something like this, then they have probably researched how to do it (we hope).
Jul
11
comment Taking password letters not whole one, is this secure?
@ewanm89 I'm not sure I follow you. Neither "crypto" or HSM's "stop keylogging" they provide storage of cryptographic material. This is useful in this case because it allows decryption of the user's passwords within the HSM under a private key that is never known.
Jul
11
comment Taking password letters not whole one, is this secure?
@ewanm89 there are various technologies in place to prevent forensic reverse engineering of secure hardware, generally including zeroing secrets when a tamper attempt is detected. @BlackFire27 MD5 is a secure hash algorithm, and is designed to be fast. It has no place as a password storage format. Instead, one should opt for a slow mechanism such as bcrypt, or scrypt if you are worried about GPU attacks.
Jul
11
comment Taking password letters not whole one, is this secure?
@PeeHaa there is a trade-off, as always. Now you only have to 'brute-force a subset of the password, but in reality, keyloggers are a much bigger threat, which is what this mechanism is designed to counter.
Jul
11
comment Taking password letters not whole one, is this secure?
The passwords are stored in an HSM, not in a reversible software format. See here for an explanation of why you can't do it in software alone.
Jul
11
comment Taking password letters not whole one, is this secure?
@PeeHaa this is perfectly reasonable practice. The only problem here is a shoulder-surfer gets the password length. This is very common practice for bank web portals around the world.
Jul
10
answered Is + as an alternative to %20 an attack vector?
Jul
7
comment What are ports?
While you're in Austin, head to Jackalope on Trinity and 6th, order the pork-shoulder burger, thank me when you get back.
Jul
3
answered How risky is connecting to a hidden wireless network?
Jun
14
answered Does Gmail 2-factor auth increase security on smartphones?
Jun
14
comment Files deleted by some Employee . How to find what time it happened and whether done from another computer on network?
I'm curious as to why you say recovering files from an ext filesystem is harder than from NTFS?
Jun
3
answered Is it worth padding passwords?
Jun
3
comment Should I put a potentially insecure program online?
I started writing an answer but just kept thinking of more and more ways this can go wrong. Basically this is fine (in fact this kind of safe system-sharing is what Unix is designed to allow) if you have a decent sysadmin to ensure the integrity of the system. You don't have such a sysadmin, so I would advise you do this on a machine that is not part of a LAN, and is not used for anything else. And do not allow user programs to open network sockets, or you will be part of a botnet in no time :P
Jun
3
comment Why should I hash passwords?
Before doing any password hashing, please PLEASE go read this answer first.
May
31
comment Can your Windows or Linux username be exposed to websites?
Without exploiting the browser, nope. But browser exploits are rife.
May
30
awarded  Enlightened
May
29
awarded  Nice Answer