Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
9
Impact
~3k people reached

Apr
5
revised Modify Certificate Subject using OpenSSL x509 Command
added 55 characters in body
Apr
5
comment Modify Certificate Subject using OpenSSL x509 Command
The CSR is provided by the end user. It's needed :)
Apr
5
comment Modify Certificate Subject using OpenSSL x509 Command
@SteffenUllrich what tool can you suggest? I'm open for alternatives. If you're talking about the openssl ca tool, then that tool has too many limitations: No simple way without hacks to set a custom serial and an insistence on a file based database.
Apr
5
asked Modify Certificate Subject using OpenSSL x509 Command
Dec
15
awarded  Nice Question
Oct
30
awarded  Popular Question
Oct
24
awarded  Popular Question
Oct
13
awarded  Excavator
Oct
13
revised How does Authy's 2FA work, if it doesn't connect to the server?
added link to blogpost explaining algorithm (not my own post, btw)
Oct
13
suggested approved edit on How does Authy's 2FA work, if it doesn't connect to the server?
Sep
10
comment Finding out whether a website uses unsalted MD5 for password hashing
Great and comprehensive answer, thanks a lot! :)
Sep
10
accepted Finding out whether a website uses unsalted MD5 for password hashing
Sep
10
comment Finding out whether a website uses unsalted MD5 for password hashing
If you have access to the database it's obvious of course :) I don't. (I did not specify that in my question though, sorry...) Regarding to MD5 / cryptographic hashes in general, I'm talking about MD5 because it's the most widespread one while at the same time being very weak with many known collisions. So it should be detectable using collisions. I'm aware that SHA1 and other widely used hash functions are also insecure and that they should never be used for password hashing.
Sep
10
comment Finding out whether a website uses unsalted MD5 for password hashing
@LucasKauffman Of course, but salted hashes cannot be detected via collision, without knowing the salt :) I'm just trying to get all the information I can.
Sep
10
asked Finding out whether a website uses unsalted MD5 for password hashing
Jun
4
accepted HMAC Based Request Signing - Storing the Salt
Jun
4
awarded  Supporter
May
22
awarded  Scholar
May
18
comment HMAC Based Request Signing - Storing the Salt
Apparently the salt isn't just a 16 byte string: stackoverflow.com/questions/8869367/… I ended up using "$2$10$" + sha256val.substring(0,22) for the moment.
May
17
comment HMAC Based Request Signing - Storing the Salt
Thanks. I didn't know about the 16 byte requirement. In that case, a MD5 of the username should be sufficiently secure to prevent rainbow table attacks. Even though that would be probably still more common than stuff like repeating the username several times and using the first 16 characters of that string...