User Stephen Touset

25 votes

Accepted

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

answered Oct 29, 2014 at 21:16

21 votes

Is encrypting SALT with given user's password more secure?

answered Sep 5, 2014 at 5:30

20 votes

Can I avoid DNS spoofing by typing the IP address?

answered Jul 17, 2013 at 0:57

19 votes

Accepted

Why does OpenSSL not include AES-256-GCM?

answered Feb 5, 2013 at 19:58

17 votes

When encrypting cloud-stored data, is it acceptable to use the user's account password?

answered Mar 25, 2016 at 18:19

15 votes

Should the average user care about DNS security?

answered Dec 12, 2016 at 22:56

14 votes

Accepted

Not storing the salt? Is that an option?

answered Aug 7, 2015 at 4:56

14 votes

Accepted

I need a good cryptography algorithm that can be encoded and decoded

answered Apr 5, 2013 at 17:52

12 votes

How is HTTP PUT and DELETE methods insecure, if they really are?

answered Jul 9, 2013 at 5:57

12 votes

Can using emojis make someone's password safer?

answered Oct 29, 2015 at 19:20

12 votes

Which passwords to exclude from a password manager?

answered May 8, 2015 at 17:21

11 votes

Is "password knocking" a good idea?

answered Feb 19, 2015 at 8:09

11 votes

Is salted MD5 or salted SHA considered secure?

answered Jun 20, 2014 at 2:03

11 votes

Accepted

What happened to MD6?

answered Apr 19, 2017 at 21:19

11 votes

Accepted

Why are KDFs slow? Is using a KDF more secure than using the original secret?

answered Oct 4, 2019 at 18:35

9 votes

Why improvising your own Hash function out of existing hash functions is so bad

answered Apr 1, 2013 at 3:10

8 votes

Accepted

How secure is MD5 for TLS message authentiaction?

answered Apr 7, 2015 at 0:37

8 votes

Is it possible to run out Public-Key servers' storage by sending them countless valid Public-Keys?

answered Aug 22, 2016 at 1:46

7 votes

Why can passwords be used to encrypt data, but are less strong for authentication?

answered Apr 2, 2016 at 4:08

7 votes

Accepted

Can the human brain generate cryptographically secure random numbers?

answered Aug 25, 2014 at 22:59

7 votes

Are RSA 2048, ECDSA, and the SHA uncrackable in the sense that AES-256 is uncrackable?

answered Apr 25, 2014 at 22:36

7 votes

A customers site had a big mysql injection attack on it, just want to learn from it

answered Apr 27, 2013 at 0:00

7 votes

Client side password hashing

answered Oct 23, 2012 at 20:02

6 votes

How much added security do I really get with a longer key size?

answered Oct 19, 2012 at 21:03

6 votes

At what point does adding more iterations to PBKDF2 provide no extra security?

answered Oct 24, 2013 at 5:40

6 votes

Accepted

Is there any reason for using private key 2 times when creating security hash?

answered Apr 7, 2015 at 22:47

6 votes

How to reduce trouble in case I lose access to my password manager?

answered Sep 19, 2016 at 7:05

6 votes

Accepted

For chip credit cards, what's preventing me from breaking the chip to trigger the magstripe failsafe?

answered Dec 31, 2017 at 2:07

5 votes

Why isn't there a Global Root for SSL?

answered Jan 8, 2014 at 22:08

5 votes

Accepted

AES using derived keys / IVs. Does it introduce a weakness?

answered Nov 13, 2012 at 18:04

Stack Exchange Network

81 Answers

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

Is encrypting SALT with given user's password more secure?

Can I avoid DNS spoofing by typing the IP address?

Why does OpenSSL not include AES-256-GCM?

When encrypting cloud-stored data, is it acceptable to use the user's account password?

Should the average user care about DNS security?

Not storing the salt? Is that an option?

I need a good cryptography algorithm that can be encoded and decoded

How is HTTP PUT and DELETE methods insecure, if they really are?

Can using emojis make someone's password safer?

Which passwords to exclude from a password manager?

Is "password knocking" a good idea?

Is salted MD5 or salted SHA considered secure?

What happened to MD6?

Why are KDFs slow? Is using a KDF more secure than using the original secret?

Why improvising your own Hash function out of existing hash functions is so bad

How secure is MD5 for TLS message authentiaction?

Is it possible to run out Public-Key servers' storage by sending them countless valid Public-Keys?

Why can passwords be used to encrypt data, but are less strong for authentication?

Can the human brain generate cryptographically secure random numbers?

Are RSA 2048, ECDSA, and the SHA uncrackable in the sense that AES-256 is uncrackable?

A customers site had a big mysql injection attack on it, just want to learn from it

Client side password hashing

How much added security do I really get with a longer key size?

At what point does adding more iterations to PBKDF2 provide no extra security?

Is there any reason for using private key 2 times when creating security hash?

How to reduce trouble in case I lose access to my password manager?

For chip credit cards, what's preventing me from breaking the chip to trigger the magstripe failsafe?

Why isn't there a Global Root for SSL?

AES using derived keys / IVs. Does it introduce a weakness?