« first day (3776 days earlier)      last day (28 days later) » 

1:41 AM
Do password hash comparisons have to be constant time?
 
 
12 hours later…
1:41 PM
@nobody, I guess they should, although I'm not sure how feasible timing attacks are in practice over the internet
 
2:06 PM
As long as passwords are salted properly, I don't see how its even possible to perform a timing attack
 
 
3 hours later…
4:40 PM
Just what?
Looking at this code, I feel like I'm back coding PHP applications in 2002
1
Q: Is it always SQL injection possible when you do not use prepared statements?

Walker18I am now learning about sql injections and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared statements the only solution? I was thinking about that and I have decided to write a piece of code ...

I upvoted because it is a good question, but this dude needs to stop writing security-critical code
 
4:58 PM
And yes, shamelessly self-promoting my answer, because your ability to make a secure query with escaping once does not mean that you will remember to do it correctly everytime:
0
A: Is it always SQL injection possible when you do not use prepared statements?

Conor Mancone tl/dr: The ability to properly escape user input once does not mean your company will do it every time. You can't. Don't even try. You have 2 good answers for the specific question you asked. However, I wanted to touch on some broader issues that are very important here: Prepared statements ar...

 

« first day (3776 days earlier)      last day (28 days later) »