56,946 reputation
397264
bio website
location
age
visits member for 3 years, 9 months
seen 1 hour ago

1h
comment How to securely hash passwords?
This is not good advice -- this answer recommends using a fast hash, which is a very bad idea (as explained in other answers).
1d
awarded  Nice Answer
2d
reviewed Reject suggested edit on Is Django's built-in security enough?
Oct
28
comment Sequential password updates
You're right to worry about the security implications of storing a bunch of old password hashes. Now an attacker has multiple targets; even if he can't crack the current password hash, he might still get lucky and crack the old password hash, which might help the attacker attack the user's other accounts on other systems -- or might even help the attacker attack the user's current password on this site, if the user is following some kind of pattern in selecting his password. The risk gain/loss equation is non-trivial; it's not clear whether the modest gain is worth the modest additional risk.
Oct
28
comment Sequential password updates
Please read security.stackexchange.com/q/4704/971. Forcing your users to change their passwords periodically is usually a bad practice, one that harms security more than it helps.
Oct
24
awarded  Announcer
Oct
24
awarded  Nice Answer
Oct
24
comment Is it possible to force a browser to use http in an ssl enabled (https) website?
1. The answer to your question will depend on how the server behaves; we don't have enough information to say. Some servers will serve pages under both HTTP and HTTPS; some won't. What have you tried? Have you tried changing the https: in the URL to http: and trying to visit that address, to see how the server responds? 2. Why can't you tag the cookie secure? Have you looked at HSTS? What research have you done?
Oct
22
comment Is there anything preventing the NSA from becoming a root CA?
@NDF1, That citation leaves something to be desired. National security letters (NSL's) predate the PATRIOT act. The PATRIOT act did not create NSL's.
Oct
21
comment Is there anything preventing the NSA from becoming a root CA?
This is pure speculation, with no citations. There are a lot of misconceptions out there about what the PATRIOT act actually says, and this looks like yet another instance of that. Speculation about legal matters from non-legal experts, without citations or evidence to back it up, is not very useful.
Oct
21
awarded  Nice Answer
Oct
20
awarded  Announcer
Oct
19
awarded  Nice Answer
Oct
18
awarded  Popular Question
Oct
16
comment XKCD #936: Short complex password, or long dictionary passphrase?
You are assuming that every password has 8 different letters that each provide an independent opportunity for substitutions. For most passwords, I anticipate that won't be the case.
Oct
14
awarded  Announcer
Oct
11
awarded  Nice Answer
Oct
10
revised Website Certificate Revocation check - Big deal?
Add the text to the question, for those who have difficulty reading it in the image, and to ensure that search will be more readily able to find this question.
Oct
10
comment Is it safe to reveal information about the OS and the software you use?
There are tons of articles on this subject out there, e.g., americanbanker.com/issues/179_18/…. I encourage you to do more research before posting a question, show us what research you've done, and use that research to frame a more specific/informed question.
Oct
10
comment Is it safe to reveal information about the OS and the software you use?
Possible duplicate of Hiding version - valuable or just security by obscurity?. (See also security.stackexchange.com/q/16133/971, security.stackexchange.com/q/4940/971, security.stackexchange.com/q/53061/971, security.stackexchange.com/q/2430/971.)