12,596 reputation
747111
bio website security.stackexchange.com
location Florida
age 32
visits member for 3 years, 10 months
seen 51 mins ago

I'm not the droid you're looking for.


1d
comment Does too long a salt reduce the security of a stored password hash?
@SPRBRN I was, literally, talking about two bits. Which is why I picked the specific number of five people. (Actually should have said four, for my intents, but my maths brain isn't warmed up yet.) In any case, the statements made regarding length still apply - the longer your salt, the less likely it'll match someone else's and the the less likely you'll have two users with the same.
1d
comment Does too long a salt reduce the security of a stored password hash?
@CodesInChaos Fair point. However, the entire purpose of salt is to eliminate the benefit of pre-computing hashes at all. If you're not using per-user unique salts, there's still some amount of benefit. Even if you're not building a full table up-front, you're effectively building one as you go through and break each user's credentials.
1d
comment Does too long a salt reduce the security of a stored password hash?
@Guillaume This discussion is really more about the security benefit of hashes, not so much about whether it's a good idea to use "god" as a password. Even if it is #1 in the attacker's dictionary though, it's still going to take them longer to match every user who has that password if the salt is unique per-user than it would otherwise. "Longer" being relative, of course, but still a non-zero difference.
1d
comment Does too long a salt reduce the security of a stored password hash?
@SPRBRN There's plenty of stupid people and bad implementations out there. I wouldn't be surprised at all if there were at least five people using two-bit salts out there. The longer yours is, the better the chance that you're not matching the next guy's. And the better chance that you won't have two users with the same salt.
2d
comment Continued Use of Kerberos
@SamuelJudson Did you just comment, or flag it for moderator attention? The latter will usually get you migrated if it's a good question and migration is appropriate.
2d
comment Continued Use of Kerberos
For future reference, please request migration instead of cross-posting.
2d
comment Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?
If the AV is doing this for all HTTPS connections, regardless of certificate validity, then you definitely do have a problem. As long as everything is running through the SSL proxy, and the SSL proxy is trusted by the browser, you have no way of knowing when a site's certificate should really be trusted or not.
Nov
23
comment Arbitrary code execution by opening a webpage by IE?
@programings For Windows XP, if you're running as an Administrator, yes. For Vista or later, it depends on the UAC configuration you have for your system and whether or not you just click-through unsolicited UAC warnings.
Nov
23
comment Is Firefox Password Manager less secure than LastPass?
A key difference between Firefox and LastPass is that the former is open-source. Would be interesting to see someone review the code to the password storage and sync functionality in Firefox and compare them to whatever details are public for LastPass.
Nov
23
comment wifi devices connected even if they give a wrong password, how can i use this vulnerability
Example: I have MAC filtering enabled at home, in "whitelist" mode. This means that only the devices I add to the authorization list can connect. However, for ease of use, the system also contains a list of MAC addresses for devices which are trying to connect. This makes it easier for me to add new devices, but does not automatically permit them access even if they have the correct password.
Nov
23
comment wifi devices connected even if they give a wrong password, how can i use this vulnerability
I'm confused. What do you mean by "subscribe" or "saved as valid devices"? If you are using MAC Address filtering, then the filtering should be based upon separately-known lists of authorized or unauthorized devices. The WiFi system itself should not, without authentication and proof of authorization, be automatically whitelisting devices just because they try to connect. However, the system will probably log their activity and register them in a list of known assets - but presence on this list alone should not imply that the assets are authorized for access.
Nov
23
comment Is a server absolutely safe if the attacker don't know unknown bug?
@shidangai Really, the question is not even valuable in the first place because it is so far separated from reality. See my update to the answer - it also would address your suggested revision.
Nov
22
comment Is it possible to modify the last time a user logged into Windows?
@Thebluefish True. Digital signatures are just another roadblock, here but they can be bypassed. Now, what's really tricky to get around is a system that's sending a live stream (or fairly frequent export) of its event logs to an aggregator. Then you've got two systems to worry about compromising and cleaning up after yourself on.
Nov
22
comment Is it possible to modify the last time a user logged into Windows?
Assuming it's possible to gain privileges to arbitrarily write to the Event Log, and there's no particularly unique digital signature applied or checked for on it, (both of which I'm pretty sure are the case) I don't see why not. However, there are likely a lot of other artifacts you'd have to mess with to render this change undetectable by an educated investigator.
Nov
21
comment Configuration file with 12-character XML-encoded passwords
@Dillinur Unfortunately, that is not an option. If these "hashes" can be easily broken, or do represent cleartext passwords, I would not want to have them on a public forum.
Nov
19
comment What is the best exploit of XSS within 100 characters?
Not a good question here, for various reasons. However, with a bit of re-scoping and clarification, it might be of interest over at Programming Puzzles & Code Golf. Narrow it down to "what is the most critical compromise possible" (according to some defined scale) and it might be good here.
Nov
12
comment Is Google's password recovery by entering an old password a bad practice?
2FA is a good recommendation, but does not at all address the question asked here.
Oct
25
comment What can my university see if they have my MAC address?
@Will I'd hardly call it extremely stupid. Certainly, MAC spoofing is a possible issue and that same threat even exists against the MAC filtering. But, unless the school wants to set up more advanced authentication mechanisms for their network, it's often the only device identifier they can rely on to identify owners in cases of abuse. It's not fool-proof, but it's better than nothing - and in most cases, it's likely to be accurate.
Oct
24
comment What can my university see if they have my MAC address?
@JamesC In the first case, network administrators have configured infrastructure devices to only permit access to approved devices, and the filtering is done by MAC address. In the second case, the infrastructure is not configured to block any devices but network admins do monitor for unrecognized devices.
Oct
24
comment What can my university see if they have my MAC address?
Perhaps a bit more definition is in order to describe "directly connected". One might translate this to mean "by a single cable between one device and another". However, MAC addresses are visible across the entire Layer 2 network - i.e.: everything connected to the same switch.