31–40 of 61 posts
Earlier quoted context omitted.
Okay I understand this much better now. I was assuming this was about remote access exploit not a local one. Point taken. Use SHA-? instead of MD5.
Yep. SHA-256 is a good bet at the moment, or SHA-3 if it's an option.
I'm a bit tired of these sinatra like web frameworks these days. Repetitive url patterns are not that elegant. Why not simply building the API around the fundamental REST concept, the resource? And what about proper content negotiation? JAX-RS has a nice API without much boilerplate and it is more powerful than most "micro web frameworks".
I fail to see the difference with http://sparkjava.com We are using Spark four new code in our product and we are happy with it.
Earlier quoted context omitted.
As I'm not up to the current security research, what is problem with using md5 hash of name+password? Is the missing salt problem you are refering to? Brute forcing md5 is easier than some other hashing algo because of collisions? (And I would disagree that knowing that how to properly hash passwords means that the whole framework itself is poorly designed)
Speed is the problem. ocl-hashcat can test in the region of 6 billion MD5 hashes a second on a decent GPU. With a random salt and, say, an 8 character password it'd take a long time, but not so long it's impossible. On a site that includes rules like 'Must have an uppercase letter', 'Must include a number', and 'Must include a special character' you actually reduce the size of the space and consequently make the pass…
Looks like simpler Java frameworks are on the rise now ( http://www.pippo.ro/ , http://sparkjava.com/ , http://www.rapidoid.org/ )
You can add this one to the list: http://www.takes.org/
[0] http://jodd.org/
[1] https://www.playframework.com/
[2] http://www.gajotres.net/best-available-java-restful-micro-fr...
[3] http://www.javaworld.com/article/2995526/developer-tools-ide...
Could someone please explain me where the benefit is over using some embedded tomcat/jetty, weld, jersey, hibernate/jdbc? Setting up such a project cost me 30 min and gives me full flexibility choosing the stack I need for my project.
Earlier quoted context omitted.
Yep. SHA-256 is a good bet at the moment, or SHA-3 if it's an option.
Not really, bcrypt is the only bet, SHA-256 is also too fast
Looks like simpler Java frameworks are on the rise now ( http://www.pippo.ro/ , http://sparkjava.com/ , http://www.rapidoid.org/ )
About time. Since the advent of java 8 the platform is rejuvenating. This is clearly an example of that.
Though, perhaps 8 has inspired framework developers, and - more importantly! - attracted a more adventurous userbase?