543 reputation
311
bio website abhibeckert.com
location Australia
age 29
visits member for 4 years
seen Aug 8 '14 at 6:53

Web, OS X and iOS Programmer


Jul
28
awarded  Popular Question
Dec
8
comment How safe is the new iOS Keychain that stores credit card numbers?
LastPass and 1Password both also store your credit card in the cloud and allow you to retrieve it. They also have weaker security than Apple.
Dec
5
awarded  Revival
Nov
29
revised How safe is the new iOS Keychain that stores credit card numbers?
added 360 characters in body; added 127 characters in body
Nov
29
answered How safe is the new iOS Keychain that stores credit card numbers?
Oct
16
comment Could SQRL really be as secure as they say?
@LateralFractal who cares if it's new or not? SQRL allows user friendly authentication where the 1st party does not expose their secret with the 2nd party or any 3rd party who might have compromised the 2nd party's security. It's an attempt to solve a real world problem that, so far, nobody else has been able to solve.
Oct
14
awarded  Commentator
Oct
14
comment Could SQRL really be as secure as they say?
"To enable SQRL for you, you have to create your master key and store it on your phone." Actually, you don't need to do that, you just need some software on your PC that can open sqrl:// URLs.
Oct
14
comment Could SQRL really be as secure as they say?
"I know that only I and one website share each one-shot password in my encrypted key-store." Right, but the advantage of SQRL is that only you are storing the password. The server on the other end also has your password and they might be compromised by a rouge employee, by the NSA, or by a hacker. With SQRL you are the only person with the private key and it's up to you to decide how secure you want it to be. You don't have to ever store it on a mobile device, the QR code is just a URL and presumably would be wrapped in an <a> tag. Just have software on your PC to handle the sqrl:// protocol
Sep
30
comment Do any security experts recommend bcrypt for password storage?
@TerisRiel I don't mind if a user's account goes offline due to a DOS attack. In the real world it doesn't actually happen, and if it does... well that's better than the account being hacked.
Sep
2
awarded  Yearling
Sep
1
comment Is the Web browser status bar always trustable?
You can't trust them. There have been a million different cases over the years where browsers have been tricked into doing something other than what the user expected. If you can't absolutely trust the page you have visited, just close the browser window. Don't touch anything. Providing links to past situations isn't very useful, because new techniques are invented regularly. Seriously, just don't trust it.
Sep
1
comment Why is password hashing considered so important?
It is incorrect to state that "old" hashing algorithms are fast and "new" ones are slow. Most hashing algorithms were never designed to be used for passwords and there are plenty of new ones that are completely unsuitable. It's off topic for this question, but basically make sure you do your homework and choose a hashing algorithm that is strong and trustworthy, or else your users will be at risk.
Aug
31
awarded  Good Answer
Aug
29
awarded  Scholar
Aug
29
accepted How do I share my S/MIME public key?
Aug
29
comment How do I share my S/MIME public key?
Thanks! I'll go with a PEM/crt file. I don't think I need to publish the CA chain, the certificate came from one of the largest SSL providers in the world.
Aug
29
revised Why is password hashing considered so important?
added 372 characters in body
Aug
29
awarded  Mortarboard
Aug
29
awarded  Nice Answer