Unable to load image

Our security auditor is an idiot. How do I give him the information he wants? (Server Fault, 2009)

https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants

As explained, this information should be easily available on any well maintained system to any competent administrator. Your failure to be able to provide this information leads me to believe you are aware of security flaws in your system and are not prepared to reveal them. Our requests line up with the PCI guidelines and both can be met. Strong cryptography only means the passwords must be encrypted while the user is inputting them but then they should be moved to a recoverable format for later use.

:marseyxd#:

119
Jump in the discussion.

No email address required.

encrypted while the user is inputting them

What the frick what the frick what the frick what the frick WHAT DOES THAT EVEN MEAN

AM I SUPPOSED TO ENCRYPT A FRICKING CLIENT-SIDE HTML TEXT BOX AFTER EVERY KEY PRESS

:#marseybangfast:

Jump in the discussion.

No email address required.

I'm going to guess it was supposed to mean "make the characters show as asterisks on the screen"

Jump in the discussion.

No email address required.

User types in abc123

Encrypt it with AES and the password "00000000".

Send it to the server.

The server decrypts it.

Jump in the discussion.

No email address required.

basically, you calculate the hash of the password h = H(p) in the webpage using js and send that over instead.

when you want to log in, the server provides a challenge C, and you return H(H(p) xor C), which the server can verify as H(h xor C)

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.