As explained, this information should be easily available on any well maintained system to any competent administrator. Your failure to be able to provide this information leads me to believe you are aware of security flaws in your system and are not prepared to reveal them. Our requests line up with the PCI guidelines and both can be met. Strong cryptography only means the passwords must be encrypted while the user is inputting them but then they should be moved to a recoverable format for later use.
Our security auditor is an idiot. How do I give him the information he wants? (Server Fault, 2009)
https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants
- 44
- 119
Now playing: Disco Train (DKC2).mp3
Jump in the discussion.
No email address required.
What the frick what the frick what the frick what the frick WHAT DOES THAT EVEN MEAN
AM I SUPPOSED TO ENCRYPT A FRICKING CLIENT-SIDE HTML TEXT BOX AFTER EVERY KEY PRESS
Jump in the discussion.
No email address required.
I'm going to guess it was supposed to mean "make the characters show as asterisks on the screen"
Jump in the discussion.
No email address required.
More options
Context
User types in
abc123
Encrypt it with AES and the password "00000000".
Send it to the server.
The server decrypts it.
Jump in the discussion.
No email address required.
More options
Context
basically, you calculate the hash of the password h = H(p) in the webpage using js and send that over instead.
when you want to log in, the server provides a challenge C, and you return H(H(p) xor C), which the server can verify as H(h xor C)
Jump in the discussion.
No email address required.
More options
Context
More options
Context