« first day (3119 days earlier)      last day (2059 days later) » 

Rick
Rick
09:01
Can I ask newbie question here?
Tom K.
Tom K.
@Rick depends on what you consider newbie
Rick
Rick
09:20
@TomK. ok let me try
I read the Dave's question, that home-brewed algorithm pasword storage question. But I still feel confused.
501
Q: Is my developer's home-brew password security right or wrong, and why?

nallenscottA developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. The software and methods in that protocol are not new, and are based on tried and tested implementa...

passwords hash bcrypt algorithm
Even if someone uses a bad, home-brewed security algorithm just like Dave, an attacker can't get the real password if the attacker only compromises the database, not the server
Mark Burnetts answer to Dave's question seems to prove my guess. security.stackexchange.com/a/25666/159875
 
2 hours later…
Tom K.
Tom K.
11:02
@Rick I'm not sure what you are confused about
Dave's algorithm is bad, but even if it weren't, Dave's argument is bad
the argument being that an algorithm's visibility is a problem, because it is good for hackers
in infosec we believe that Kerckhoff's principle applies here. This means that even if your algorithm is visible it has to withstand attacks
in addition: visibility grants analysis by cryptographers and this improves your algorithm
 
5 hours later…
StrongBad
StrongBad
16:31
security.stackexchange.com/questions/212718/… is a cross post of security.stackexchange.com/questions/212718/… it also contains a link to a site with malware.
The previous edit does not contain a warning an maybe should be redacted by a mod, but you are all probably smart enough not to click on random links.

« first day (3119 days earlier)      last day (2059 days later) »