Viewing profile — pmylund

Disclosure: I work for Evidon. Evidon provides reports to different types of companies that give them information about what trackers appear where, how prevalent they are and/or wh…

And here's why: http://stackoverflow.com/a/5411601/620239 . Forgot to change that first occurrence after pasting it in. "Oh, it works. I'm done."

And Go lets you do that. You just return the error. Try writing a few things in Go. I very much doubt you'll respond like this afterwards.

Nice save.

Famous last words :)

Thanks for this example. I wasn't trying to be condescending when I asked how it was significant. I really didn't understand what you meant. I've added a note to the article.

Nm. Got it.

It's not that the size doesn't matter; it's just that it's not as significant. It becomes very, very hard to compute rainbow tables after just a few random bytes. No matter how lon…

How does this matter given a proper avalanche effect?

I agree, but "outsourcing" includes using libraries written by people who know what they're doing. (And not using libraries written by people who know what they're doing, but which…

Sure, but I try to not make any assumptions without being boring. I think the goto-link at the beginning works fairly well.

OpenID and OAuth really did a lot, but there's just nothing called "don't use passwords." Fingerprint readers suck. Anything biometric that doesn't suck costs too much, and 99% of …

So something like a HMAC digest generated using a pepper stored in the source code/binary or on disk before passing it to bcrypt/scrypt? :) This only really protects against SQL in…

You're right. That was an unfortunate choice of words.

I'm not sure I agree that it would matter, but, either way, using a constant-time equality function might have given readers the impression that my code was safe to use. It isn't. …

So much for white-boarding it. Fixed, thanks.

FWIW I included scrypt :) I personally agree that "Use bcrypt." should become "Use scrypt." soon. My main gripe is that there is far less library support for it, at least for now.

Although it's not that much if you're using a long hash, iterating a hash function causes you to lose entropy. The implementation in the article is basically PBKDF (1). PBKDF2/HMAC…

I agree there are a ton of articles saying "Use bcrypt." After Coda's post ( http://codahale.com/how-to-safely-store-a-password/ ) it's almost become a meme. I don't, however, thin…