10,966 reputation
63698
bio website security.stackexchange.com
location Florida
age 31
visits member for 3 years, 3 months
seen 2 hours ago

I'm not the droid you're looking for.


2d
comment How can I add a layer of security to cleartext passwords and SSL?
Assuming SSL is compromised, as this thought exercise requires, this does protect the username/password from direct exposure. However it does not protect it from eventual compromise by brute-force against the hash. It also doesn't protect it against reuse by the attacker - effectively, the hashes have become the username & password and the attacker would just replay those over the wire.
Apr
21
comment Why would a website allow answers to security questions to be used interchangeably?
Everyone commenting on the quality of the security questions & answers here: Please remember that the OP has posted these only as examples for demonstration and, in fact, has explicitly stated that these are not the ones he's actually using.
Apr
10
comment Can an external tool accurately determine the current vulnerability of a site to Heartbleed? How? Was vulnerability remediated?
@BillR security.stackexchange.com/questions/55083/…
Apr
9
comment Does xkcd.com/1353 overstate heartbleed's capability?
@RubberDuck See here: explainxkcd.com/wiki/index.php/Category:Characters for a list of XKCD characters.
Apr
9
comment Does xkcd.com/1353 overstate heartbleed's capability?
As you've said in your self-answer, it is not likely that Heartbleed can read memory from outside of the web server's own process. However, the important thing to bear in mind is that everything Megan enumerates in her first three lines may indeed be in that process' allocated memory space. Literally anything the website sends to or receives from its users is at risk, as well as some supporting data (e.g.: the private keys) required for the web server's operation.
Apr
8
comment HeartBleed - How to detect compromised websites
Note that changing your password on the site is only really valuable after the site has been patched so that it is no longer vulnerable.
Apr
8
comment HeartBleed - How to detect compromised websites
There are ways to determine whether a site is currently vulnerable, but what makes this issue so critical is that sites which are not currently vulnerable (but were in the past) may have been exploited before. There's no way for system administrators to know if their site has been previously exploited, and there is no way for users to tell if there's a MitM who's exploited a site because the attacker would be using the legitimate original certificates.
Apr
4
comment How many possible combinations in 8 character password?
@Adnan That's the number of possible passwords without restrictions on any of the characters - not what's being looked for here.
Apr
4
comment How many possible combinations in 8 character password?
This might be useful: math.stackexchange.com/q/497257
Apr
4
comment How many possible combinations in 8 character password?
Also of note, that password policy is ridiculously weak. 8-character passwords haven't been "strong enough" for quite some time. 12 is the new 8, but many are recommending 15, 20, or more. And please don't ever implement something that imposes a maximum length on the password. (Or at least, not a maximum that can be measured in two digits.)
Apr
4
comment How many possible combinations in 8 character password?
Your second suggestion seems right - and can be shortened to (26^2)*10*33*(95^4) - but something feels just a little off about it. Regardless, this is off-topic for Information Security. It might be on-topic for Mathematics. We'll see if they want it migrated.
Apr
3
comment Watching for applications like WireShark and other eaves dropping on corporate network
Of course, this assumes that only company-approved systems are attached to the network, and nobody is using these tools from a thumb drive, and nobody would ever use a Live CD...
Mar
24
comment Why should I care if a site uses encryption or not if I'm not exchanging any sensitive data?
Encryption on its own does nothing to prove that data in transit has not been modified. For that, you need authentication which is normally provided through digital signatures. This is also a component of SSL, but the two should not be confused.
Mar
6
comment How To Protect Tomcat 7 Against Slowloris Attack
Thanks for the links, but answers on StackExchange are expected to be primarily self-contained - that is, links to supporting documentation may be included but should not be relied upon to resolve the problem.
Mar
5
comment What is wrong with a confirmation page displaying my password?
Showing the password online and including it in an e-mail, as part of the registration process, doesn't necessarily say anything about the long-term storage mechanism - though it definitely indicates some bad practices. What's the password reset/recovery procedure like? i.e.: If you forgot your password, will they e-mail/show it to you?
Mar
5
comment What is wrong with a confirmation page displaying my password?
The most recent edit to the question indicates the password is also being e-mailed. So, regardless of how it is stored on the EventsOnline servers, it's most definitely being stored/transmitted insecurely at some point in the e-mail process.
Mar
4
comment Is storing plaintext passwords for email accounts any less bad?
@MattConnolly I believe Lucas meant to imply the use of salt when he said "performing correct password hashing". He probably just felt that the question is a bit too pedestrian to bother with providing any answer more complete than what he did - any security-minded individual with a lick of sense regarding the Internet should easily recognize that e-mail accounts are among the most high-value online accounts one might have (arguably more so than financial accounts) and therefore should be the last account for which cleartext password storage might be deemed acceptable or "less bad".
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
... Even if this could tell us whether hashing/salts are used, it still wouldn't help differentiate between bad practices (weak/fast algorithms, common salts) and good ones (strong/slow algorithms, unique-per-account salts).
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
@theGreenCabbage Usage of Recovery vs. Reset processes is not a good indicator to differentiate between good password storage practices and bad ones. While a Recovery process definitely indicates bad storage practices (though it does not specifically indicate cleartext storage - encryption, not as bad as cleartext but still a bad practice, may still be used), a Reset process can just as well be in place with cleartext storage as it may with hashed/salted storage. ...
Mar
3
comment Is storing plaintext passwords for email accounts any less bad?
Nevermind the fact that the e-mail account is typically a gateway to password resets for every other account.