57,849 reputation
3101270
bio website
location
age
visits member for 3 years, 11 months
seen 7 hours ago

1d
awarded  Notable Question
2d
awarded  Good Answer
2d
awarded  tls
2d
awarded  tls
2d
awarded  Announcer
Dec
12
comment Is a rand from /dev/urandom secure for a login key?
@Pacerier, there's not enough space in this comment to give a nuanced explanation. Suffice it to say that the practical implications of that paper for this question are extremely limited. See e.g. mail-archive.com/cryptography@metzdowd.com/msg13301.html (focus on the technical content). See also mail-archive.com/cypherpunks%40cpunks.org/msg01390.html and mail-archive.com/cypherpunks%40cpunks.org/msg01365.html. If you want to understand better, ask a separate question on Crypto.SE. Please don't use comments to ask questions; post a new question.
Dec
9
asked Security analysis of Dashlane
Dec
7
awarded  Announcer
Dec
4
comment Do I have to hash users' IP addresses when I log them?
I didn't downvote, but we prefer detailed answers (especially when there are already some other fairly extensive answers). A small tidbit is often better as a comment or an edit to another more comprehensive answer.
Dec
4
comment End user security awareness measurement
Useful question! I encourage you to flesh out your question a bit more. You might start by spelling out the acronym "KPI" (to help others find your question via search) and explaining what research you've done and what you've found.
Dec
4
comment What is the difference between login throttling and temporary account lockout?
And don't forget to take into account concurrent attempts to log in. Someone can open two tabs, or connect from two different IP addresses; if an attempt to log in as user U from one address fails, how do you plan to treat an attempt to log in as user U from the other address? Finally, keep in mind that these only help against targeted attacks (the attacker has a specific user whose account he wants access to) but not untargeted attacks (the attacker wants to get into any valid account, he doesn't care which).
Dec
4
comment What is the difference between login throttling and temporary account lockout?
I find your question not very clear. Why don't you define what you mean by "login throttling" vs "temporary lockout"? Or are you looking for a definition of those terms? Please note that there is a significant difference between limiting ability for a specific username to log in (temporarily marking that user so their account cannot be logged into for the next 10 seconds, say) vs limiting ability of a specific session to log in (temporarily marking a session ID or IP address so it cannot log in as any user for the next 10 seconds).
Dec
3
comment Why must I have a “strong” password for sites like this?
If your question is specifically about Stackexchange, would you be amenable to migrating it to Meta.stackexchange? If it's only about SE I don't think this is the best place for it. If your question is not specifically about Stackexchange, do you have any objections to editing it so it's not specifically about Stackexchange but applies more generally?
Dec
3
comment Why must I have a “strong” password for sites like this?
Please do more research before asking. This has already been asked and answered and analyzed in great detail previously. If you are asking about technical analysis of the password requirements for a login provider or sites in general, see security.stackexchange.com/q/3913/971 (asked by StackExchange folks to help them choose their policy). If you are asking about StackExchange sites specifically, this question belongs on Meta.StackExchange, not Security.SE; in that case, see meta.stackexchange.com/q/187759/160917 and meta.stackexchange.com/q/110678/160917.
Dec
1
awarded  Notable Question
Dec
1
awarded  Notable Question
Nov
29
comment Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them?
Apparent duplicate of security.stackexchange.com/q/24195/971 or security.stackexchange.com/q/67124/971.
Nov
24
comment Keeping user data private in a cloud environment like Google App Engine
@DavidMeister, doesn't help. The web page will have a <SCRIPT SRC=https://github.com/foo.js> tag, and the admin who controls the contents of the web page can change that tag to point to some other (malicious) Javascript. See the 3rd bullet item in my answer.
Nov
19
awarded  Popular Question
Nov
17
awarded  Nice Answer