MattPalmer1086

145 ms·

1. 2221.▲
   by MattPalmer1086 8y ago

   If I got the hash database I could absolutely test whether specific people were in it, and I could probably reverse a large number of them with dictionary based attacks. There are no completely robust options where you can claim that this d
2. 2222.▲
   by MattPalmer1086 8y ago

   I wouldn't say don't do this, although you do have to spend your security resources carefully. While it only provides additional security against password database exfiltration attacks, it is also a very, very low cost mitigation.
3. 2223.▲
   by MattPalmer1086 8y ago

   If they could brute force just one hash they would know the pepper. But this is already infeasible if the pepper has sufficiently high entropy.
4. 2224.▲
   by MattPalmer1086 8y ago

   I always saw this as meaning capable people are not threatened by working with other capable people so try to hire the best, whereas mediocre people see people more capable than themselves as a threat, so hire below their ability. Obviously
5. 2225.▲
   by MattPalmer1086 8y ago

   I mostly agree with the points you're making, but... > Security unwilling to own risk Security cannot fundamentally own risks created by other parts of the organisation. I'd actually put it the other way around - the organisati
6. 2226.▲
   by MattPalmer1086 8y ago

   I'd be remiss not to note that there are better and still simple variants of Horspool that outperform the vanilla algorithm. In any case, if you'd like to discuss search algorithms when you want to implement them, I'd be happ
7. 2227.▲
   by MattPalmer1086 8y ago

   Absolutely true that there isn't a single algorithm that beats all the others. Of the general string search algorithms which don't use specialized CPU instructions to obtain speedups, I would recommend: 1. ShiftOr for short string
8. 2228.▲
   by MattPalmer1086 8y ago

   Boyer Moore is OK, but there are better algorithms available. The simpler Horspool variant is usually a fair bit faster and also easier to implement. For short strings, e.g. less than 12 character, the ShiftOr algorithm is hard to beat. I