pmylund
Joined 16 years ago
Karma
107
Submissions
35
Member since
Oct 3
Recent submissions
Comment · 13 years ago
Comment · 13 years ago
And here's why: http://stackoverflow.com/a/5411601/620239. Forgot to change that first occurrence after pasting it in. "Oh, it works. I'm done."
Comment · 14 years ago
And Go lets you do that. You just return the error.
Try writing a few things in Go. I very much doubt you'll respond like this afterwards.
Comment · 14 years ago
Nice save.
Comment · 14 years ago
Famous last words :)
Comment · 14 years ago
Thanks for this example.
I wasn't trying to be condescending when I asked how it was significant. I really didn't understand what you meant.
I've added a note to the article.
Comment · 14 years ago
Nm. Got it.
Comment · 14 years ago
It's not that the size doesn't matter; it's just that it's not as significant. It becomes very, very hard to compute rainbow tables after just a few random bytes. No matter how long the salt is, it doesn't do anything to prevent somebody from trying to guess the original input for a given digest using a brute force approach, though. So usually the salt has less than e.g. 256 bits of entropy just because it takes up less space.
Sure, a very large salt might slow down the first iteration a little (but not necessarily subsequent ones, and it wouldn't require more memory, at least with most hash functions), so you're almost always better off just stretching the key--then you save the storage costs too.
Comment · 14 years ago
How does this matter given a proper avalanche effect?
Comment · 14 years ago
I agree, but "outsourcing" includes using libraries written by people who know what they're doing. (And not using libraries written by people who know what they're doing, but which are the wrong tools for the job.)
Comment · 14 years ago
Sure, but I try to not make any assumptions without being boring. I think the goto-link at the beginning works fairly well.
Comment · 14 years ago
OpenID and OAuth really did a lot, but there's just nothing called "don't use passwords." Fingerprint readers suck. Anything biometric that doesn't suck costs too much, and 99% of people don't have them. A good KDF is not bad in comparison to a centralized authentication server considering other factors.
Someone, somewhere will be storing user passwords/digests for the foreseeable future. And they will do it incorrectly.
Evidon provides reports to different types of companies that give them information about what trackers appear where, how prevalent they are and/or whether they're in compliance with privacy laws. High-level reports, not "your data."
pokoleo forgot to mention that 1. GhostRank, the feedback feature of Ghostery, is very explicitly opt-in: no data is collected unless you enable it, and 2. We anonymize all of the data that's collected. We have no interest in tracking individual GhostRank users. What's interesting to us is being able to say "This tracker appears on the most websites, or causes the biggest slow-down of a page load on average."
More details here:
- http://purplebox.ghostery.com/?p=1016023438
- http://www.ghostery.com/faq#q14