Timeline for Should you always pass the bare minimum data needed into a function in cases like this
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 11, 2014 at 5:43 | comment | added | Izkata | @GlenPeterson See this question on hashing multiple times. It can be more secure if you're careful about it, but more likely than not it will become less secure due to collisions. Hence, as BenLee suggested, use bcrypt, which is built to do this safely. | |
| May 10, 2014 at 19:50 | comment | added | SeattleCplusplus | User.IsAdmin() is a fine choice even if there is a security manager that must be consulted. User.IsAdmin() hides implementation; how much info is needed to validate the user. Sure User may call SecurityManager.IsAdmin(id, name, pw), but at the SecurityManager level that's ok because this is what SecurityManager needs to validate a user. | |
| Nov 5, 2013 at 9:10 | comment | added | Ben Lee | @GlenPeterson, my suggestion: Use bcrypt | |
| Nov 4, 2013 at 13:36 | comment | added | Gusdor | @GlenPeterson Triple DES makes brute force take longer. That is not the same. I do not have a source however. | |
| Nov 4, 2013 at 13:34 | history | edited | GlenPeterson | CC BY-SA 3.0 |
added 7 characters in body
|
| Nov 4, 2013 at 13:26 | comment | added | GlenPeterson | @Gusdor: I have never heard that before and have repeatedly heard the opposite. Triple DES makes DES stronger by applying it three times. Do you have a reference or source to back up your comment? | |
| Nov 4, 2013 at 12:38 | comment | added | Marjan Venema | Well spotted (the difference in perspective). Upvoted the question you linked (very well written up). Refraining from answering as I see you already got several ones that are expressing my views better than I was in my comment. | |
| Nov 4, 2013 at 12:17 | comment | added | GlenPeterson | @MarjanVenema: I am not deliberately being difficult. I think we just have very different perspectives and I would like to understand yours better. I have opened a new question where this can be better discussed: programmers.stackexchange.com/questions/216443/… | |
| Nov 4, 2013 at 9:36 | comment | added | Gusdor | @GlenPeterson Totally off topic, but multiple rounds of hashing and cryptographic functions will weaken the data. | |
| Nov 4, 2013 at 7:32 | comment | added | Marjan Venema | @GlenPeterson: are you deliberately misunderstanding me? When I said user, I of course meant the user class. | |
| Nov 3, 2013 at 23:57 | comment | added | GlenPeterson | @MarjanVenema The user isn't deciding anything. The User object/table stores data about each user. Actual users don't get to change everything about themselves. Even when the user changes something they are allowed to, it may trigger security alerts like an email if they change their email address or their user ID or password. Are you using a system where users are magically allowed to change everything about certain object types? I am not familiar with such a system. | |
| Nov 3, 2013 at 20:39 | comment | added | jmort253 | Sigh, unfortunately we'll be making the "don't store passwords in plain text" arguments until the end of time, or until Google or someone waters down the languages to the point where the programming language handles it all for you. :D Maybe continually reiterating it eventually gets through to people, and if it gets through to one, then I guess that's worth continuing on! :) | |
| Nov 3, 2013 at 19:43 | comment | added | Marjan Venema | A user shouldn't decide whether it is an Admin or not. The Privileges or Security system should. Something being tightly coupled to a class doesn't mean it is a good idea to make it part of that class. | |
| Nov 3, 2013 at 15:06 | history | edited | GlenPeterson | CC BY-SA 3.0 |
added 243 characters in body
|
| Nov 3, 2013 at 14:55 | history | edited | GlenPeterson | CC BY-SA 3.0 |
added 622 characters in body
|
| Nov 3, 2013 at 14:50 | history | answered | GlenPeterson | CC BY-SA 3.0 |