For a login system in php would this be a suitable outline of how it would work:
users types in username and password, clicks login button.
Checks if user exists in database,
if it does, then retrieve the salt
for that user
hash the password and
salt (would this be done on the
client or server side? I think
client side would be better, but php…
I'm building a 3D tic-tac-toe game and this is what I've implemented so far:
3D renderer with texture mapping
Playing against the computer
Playing online (multiplayer)
Now I'm a little lost what I could add. Obviously, tic-tac-toe isn't that exciting or advanced, but I just miss something to salt it a little bit.
Therefore, could anyone…
In this article, Ashic Mahtab shows an elegant, reusable and unobtrusive way in which to persist sensitive data to the browser in hidden inputs and restoring them on postback without needing to change any code in controllers or actions. The approach is an improvement of his previous article and incorporates a per session salt during…
<b>Tux Radar:</b> "For the tinkerers and testers, 2010 is shaping up to be a perfect year. Almost every desktop and application we can think of is going to have a major release, and while release dates and roadmaps always have to be taken with a pinch of salt, many of these projects have built technology and enhancements…
OK, pretty much any DBA worth their salt has read Brent Ozar's (Blog | Twitter) blog about getting a baseline of your server's performance counters and then getting the same counters at regular intervals afterwards so that you can track performance trends and evidence how you are making your servers faster or cope with extra load…
[ WEB 3.0 DESIGN - WEBREDESIGNMIAMI.COM ] We get calls all the time from people asking "How much does a website cost?", as if web design was an undifferentiated commodity like salt or sugar. It is no... [Author: Bruce Arnold - Web Design and Development - April 24, 2010]
<b>Groklaw:</b> "Here's what the Salt Lake Tribune reports happened today at the SCO v. Novell trial, all of which it records as if it were all so. Let's see if it is, by comparing what is reported about the testimony with what we already know. Part of what Groklaw does is insist on checking facts. So, let's do that."
While talking with one of my coworkers, he was talking about the issues the language we used had with encryption/decryption and said that a developer should always salt their own hashes. Another example I can think of is the mysql_real_escape_string in PHP that programmers use to sanitize input data. I've heard many times that a…
<b>Groklaw:</b> "Would it surprise you to find out that it turns out that apparently one of the jurors might be related to one of SCO's prior corporate officers? At any rate they have the same last name, and Salt Lake City is a big place, so perhaps not."
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a developer hate it when a website requires a complex password), what are the actual benefits of having strong passwords (for website…
Mars Mania and the Google Maps APIs!
Interested in learning how to use the Google Maps API and WebGL to create a dynamic terrain lighting map of the surface of Mars? Or how about using the Street View API and a bit of ImageMagick to view the high resolution panoramic images from the Curiosity Rover? Since Curiosity's touchdown,…
By Brendan B. Read, TMCnet.com, April 5, 2010
Oracle Makes Social Services More Effective with New Oracle Social Services Suite
Overworked, with too frequently heart-wrenching cases yet cash-strapped, social service agencies now have a new solution that has been expressly designed to help them accomplish more for their clients…
I'm seeing very strange performance characteristics on one of my servers. This server is running a simple two-disk software-RAID1 setup with LVM spanning /dev/md0. One of the logical volumes /dev/vg0/secure is encrypted using dmcrypt with LUKS and mounted with the sync and noatimes flag. Writing to that volume is incredibly slow…
In our normal cooking, we substitute the vegetables for the gravies we prepare. When we start baking, we look for a good recipe. At least one or two ingredient will be missing. We do not know where to substitute what to bring same output. So we finally drop the plan of baking. Again after a month, we get the interest in baking.…
Hi,
I want to make an application for my phone (Nokia N900) It uses the Maemo Platform, which is a Linux variant. Most applications are made with either QT or Python, i only have experience in C#, and am wondering if it is at all possible to convert C# to QT, or would i have to use something like Mono or Vala to write the code…
Solaris 11 is here!
And together with the official launch activities, a lot of Oracle and non-Oracle bloggers contributed helpful and informative blog articles to help your datacenter go to eleven.
Here are some notable blog postings, sorted by category for your Solaris 11 blog-reading pleasure:
Getting Started/Overview
A lot…
I am (finally) attempting to write some integration tests for my application (because every deploy is getting scarier). Since testing is a horribly documented feature of Rails, this was the best I could get going with shoulda.
class DeleteBusinessTest < ActionController::IntegrationTest
context "log skydiver in and"…
I'm building an ASP.NET MVC application that uses a DDD (Domain Driven Design) approach with database access handled by NHibernate. I have domain model class (Administrator) that I want to inject a dependency into via an IOC Container such as Castle Windsor, something like this:
public class Administrator
{
public…
I'm using a Linq-to-SQL class called Scans.dbml.
In that class I've dragged a table called Users (username, password, role) onto the graphic area and now I can access User object via a UserRepository class:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
namespace…
I've come across a system that is in use by a company that we are considering partnering with on a medium-sized (for us, not them) project.
They have a web service that we will need to integrate with.
My current understanding of proper username/password management is that the username may be stored as…
I have a security class:
public class security
{
private static string createSalt(int size)
{
//Generate a random cryptographic number
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] b = new byte[size];
rng.GetBytes(b);
//Convert…
This is what my user model looks like:
namespace Api.Models
{
public class User
{
[BsonId(IdGenerator = typeof(StringObjectIdGenerator))]
[BsonRequired]
public string Id { get; set; }
[Required(ErrorMessage = "Username is required.")]
…
In implementing my site (a Rails site if it makes any difference), one of my design priorities is to relieve the user of the need to create yet another username and password while still providing useful per-user functionality.
The way I am planning to do this is:
User enters…
Inspired by my previous question, now I have a very interesting idea: Do you really ever need to use Rfc2898DeriveBytes or similar classes to "securely derive" the encryption key and initialization vector from the passphrase string, or will just a simple hash of that string…