Viewing profile — timo_h

As a side project for a hockey manager game, I created a small audio tracker, "HM Tracker," which was used to make the game's music. It is a browser-based tracker-style music works…

The same principle applies to SHA-512 just the same (much cheaper to attack non-stretched SHA-512 hash than attacking directly the bcrypt hash). There are both MD5 hashes and SHA-5…

> When using bcrypt, make sure to use the following algorithm to prevent the leading NULL byte problem. and the 72-character password limit: > bcrypt(base64(sha-512(password))) Pre…

Firefox is great on desktop, been my primary browser for 15+ years. Sadly though, the mobile version (still) lacks support for "pull to refresh" gesture. Other than that, mobile FF…

This was probably the most notorious misuse of scrypt. Memory usage of scrypt was tuned to take 128KB, which made Litecoin mining ~10 times faster on GPUs than on CPUs.

Some of this is good advice, but there's a BIG point on the 'Password Storage Cheatsheet' that's linked and referenced by the above article, that I don't think is solid. I read the…

Before the Breaker 101 course starts, I invite you to take a quick (15 questions) quiz about web application security practices and quirks: http://timoh6.github.io/WebAppSecQuiz/in…

> That's defending against a newly generated rainbow table. You lost me here. Anyway, the attacker does not need a rainbow table at all to attack against multiple hashes at the pri…

> I don't understand how salts could help against timing attacks, though. The salt which is unknown/unpredictable (and contains enough entropy) to the attacker makes his offline at…

At least, testing passwords against multiple hashes (at the price of one) is impossible. And it is not possible to see if different entries shares a same password (or to see if the…

> But salts don't have to be strictly unique, they only have to be a barrier to rainbow tables. Rainbow tables are not the only "attack vector" that proper use of salts defeats.