|
ahmed_one wrote: I've found lots of suggestion for encrypt the password is far better then salted and hashed method
Where? The consensus from every decent security expert is that salted hashed passwords are far superior to encrypted passwords.
Even if the encryption key isn't compromised, encryption tends to produce the same output given the same input, which can make it trivial to compromise a large number of user's passwords. For example: http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/[^]
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
ahmed_one wrote: I've found lots of suggestion for encrypt the password is far better then salted and hashed method
Anyone who understands the difference can point out that this is incorrect.
If you store my password (encrypted), then YOU (and your boss, and everyone else in your company, and all subcontractors, and the cleaning-lady when you're AFK) will be able to decrypt the password. Next to having access to all the data you're supposed to secure, there's a huge chance that the user recycled one of his old passwords. Enough databases leaked with encrypted passwords to give us a nice and huge dictionary.
Salt and hash, or omit the password entirely; the only thing worse than no security is a FALSE sense of security.
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
|
|
|
|
|
when creating new user account the password is encrypted via AEC_ENCRYPT function of mysql using a secret key which is only known by me.
Let's say user James's account is created with:
Username: James
Password: somesecretword
Now when password is saved in mysql db using AES_ENCRYPT it becomes something like "$-3+%,%kjunbsnd". Now when validation procedure is called it is using the AES_DECRYPT function using same key only i know, which validates the password alongwith username..
My question is how can anyone including the cleaning lady find the actual password without knowing the secret key?
Please do not consider this reply as argue, I am only a beginner trying to learn from experience masters like you.
Thanks
Ahmed
|
|
|
|
|
ahmed_one wrote: using a secret key which is only known by me.
Bullshit! It's known by the system because the system needs the key to unencrypt the password. Can you GUARANTEE with YOUR LIFE that your system is unhackable and there is zero chance of anyone else getting that key?? If you answer yes, quit your job right now because you're lying to everyone, but even worse, you're lying to yourself.
ahmed_one wrote: Now when password is saved in mysql db using AES_ENCRYPT it becomes something like "$-3+%,%kjunbsnd". Now when validation procedure is called it is using the AES_DECRYPT function using same key only i know, which validates the password alongwith username..
This is completely INSECURE! The best security systems do NOT compare a typed password against a decrypted password. They compare a hashed password against the hash in the database. No decryption necessary and the passwords are never "out in the open" in decrypted form.
YOU ARE HELL BENT ON DOING THIS THE WRONG WAY! DON'T DO IT!
|
|
|
|
|
ahmed_one wrote: which is only known by me.
That's the problem. You should not have access to other people's passwords, end of story.
ahmed_one wrote: I am only a beginner trying to learn from experience masters like you.
If you did, you'd be asking for explanation on the salt.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
|
ahmed_one wrote: I've found lots of suggestion for encrypt the password is far better then salted and hashed method
Really? I'd be willing to bet every single one of those "suggestions" was written by a security moron. The problem with encrypting a password is that it can be unencrypted and therefor broken. A salted and hashed password cannot be reversed to get the original string, making it FAR more secure.
|
|
|
|
|
just to answer you question - ExecuteNonQuery() return the number of rows effected which is zero ! Try using ExecuteScalar() !
Shujaat
|
|
|
|
|
I am reading a file and extracting a string
AB01AN728930JJ7YI8
VD036583AH84000002
In this string we have differenct section like AB,01,AN728930,JJ7YI8 in one line second line has VD,036583,AH84,000002
now there will be predefined line and predefined sections in string and each section will have some common validation like length, data type etc.
What is the best way of processing the validation on each character set
|
|
|
|
|
Try regex, The 30 Minute Regex Tutorial[^]
This tutorial will take you more than 30 minutes to read and understand if you are the first timer.
Formulate the regex patterns according to your respective validation rules.
|
|
|
|
|
how to read character from a particular position to a particular position in REGEX
|
|
|
|
|
You don't. RegEx uses patterns to match against, not positions.
If you know the specific positions, then you can just use the Substring method of the String class to get it. Start at this position and return x number of characters.
|
|
|
|
|
How many variants are there on the split up of the string ? - you show two, ie,
If String Starts With 'AB', then Format is AB, XX, YYYYYYYY, ZZZZZZ
If String Starts With 'VD', then Format is VD, XXXXXX, YYYY, ZZZZZZ
Before you go reaching for Regex, Id almost be suggesting that you look at Recursive Descent Parsing, or a parser based on a Grammar, using ANTLR perhaps - this would allow you to have rules, validation built in
'g'
|
|
|
|
|
how to split all hindi unicode characters.
StringBuilder sb = new StringBuilder();
string[] data = textBox1.Text.Split(new char[] { ' ' });
foreach (string s in data)
{
Regex ex = new Regex(@"(\w|\d)",RegexOptions.CultureInvariant);
MatchCollection col = ex.Matches(s);
foreach (Match mat in col)
{
// string d = Worddictonary[mat.ToString()];
sb.Append(mat.ToString());
sb.Append("\n");
}
}
For the input मोहनदास I am getting the output as
म ह न द स
The desired output is
म ो ह न द ा स
Can anyone please help to split Unicode Hindi string. Its very urgent.
Thanks in advance..
|
|
|
|
|
Unfortunately the 'normal' rules for string splitting often do not work for non-Latin languages. You will have to write your own parser that recognises the different characters.
Veni, vidi, abiit domum
|
|
|
|
|
string[position] returns the character at the given position. I just tested it with your example text, and it worked correctly:
private void button1_Click(object sender, EventArgs e)
{
StringBuilder sb = new StringBuilder();
for (int i = 0; i < textBox1.Text.Length; i++)
{
char indianChar = textBox1.Text[i];
sb.Append(indianChar);
sb.Append(" ");
}
MessageBox.Show(sb.ToString());
}
|
|
|
|
|
I am working on a touch surface, I need to create two desktops on a single surface running on a single Operating System (Windows 7), so that two users can simultaneously use them. Please guide me where to start and provide related links.
|
|
|
|
|
Saad.0071 wrote: Please guide me where to start and provide related links.
Google and MSDN would be the logical choice.
Veni, vidi, abiit domum
|
|
|
|
|
Only a single desktop can be shown simultaneous. That's a technical limitation in Windows.
You could show two remote desktops on a single screen.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
|
|
|
|
|
Do I understand that correctly:
- there is only one computer.
- that computer runs Windows 7
- there are two monitors attached to this computer.
- there are two users, each of them uses one of the monitors
The limitation of Windows 7 is that only one user can have an interactive session at a time. Hence, from the point of view of Windows, there is only one user in your scenario (i.e. both of your users work in the same session, with the same Windows account).
All user interface elements run in the UI thread of the program instance - a real multitasking is not possible with the user interface. You could circumvent that by starting two instances of your program. Each instance would communicate with a "server" (a Windows Service) which provides the back-end for your UI applications and which may run on the same computer.
|
|
|
|
|
Hi
Leslie Sanford created a midi toolkit:
http://www.codeproject.com/Articles/6228/C-MIDI-Toolkit
I have a question:
How we can store (For example in a text file) the converted midi to frequecy list and duration.
thanks
|
|
|
|
|
If you have a question about an article, use the forum at the bottom of the article:
C# MIDI Toolkit : Comments & Discussions[^]
The author of the article will be the person most likely to be able to answer your question.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Thanks
I asked but no reply is received yet!
|
|
|
|
|
Sorted I was being stupid, cant believe I had trouble with that.
modified 23-Jan-14 8:47am.
|
|
|
|
|
Why do you think I am going to go a a random site and download random code, the size and nature of which I do not know? Why do you think I want to search your code to find the code you write about? Do you think that is a good use of my time?
Edit your question, remove the links, and paste the relevant code fragments - just the bits with the problem and a few lines around for context - to make it easier for us to identify your problem.
Help us to help you!
Those who fail to learn history are doomed to repeat it. --- George Santayana (December 16, 1863 – September 26, 1952)
Those who fail to clear history are doomed to explain it. --- OriginalGriff (February 24, 1959 – ∞)
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
