Comments for MicroSYNC Network Blog http://blog.microsync.net Technologies is changing the world, and our life... Wed, 10 Mar 2010 13:05:06 +0000 http://wordpress.org/?v=2.9.1 hourly 1 Comment on Authentication account Joomla on ASP.NET applications by Mr.AD http://blog.microsync.net/asp-net/authentication-account-joomla-on-asp-net-applications/comment-page-1/#comment-42 Mr.AD Wed, 10 Mar 2010 13:05:06 +0000 http://blog.microsync.net/?p=5#comment-42 Hi, Thanks for your comment ! Send me the link you 're talking about, please ! I want to know what the content it contained ! Thanks ! Hi,

Thanks for your comment !

Send me the link you ‘re talking about, please ! I want to know what the content it contained !

Thanks !

]]> Comment on Authentication account Joomla on ASP.NET applications by StUnT http://blog.microsync.net/asp-net/authentication-account-joomla-on-asp-net-applications/comment-page-1/#comment-41 StUnT Wed, 10 Mar 2010 08:23:16 +0000 http://blog.microsync.net/?p=5#comment-41 I am reading this article second time today, you have to be more careful with content leakers. If I will fount it again I will send you a link I am reading this article second time today, you have to be more careful with content leakers. If I will fount it again I will send you a link

]]> Comment on Hello world! by Koobalou http://blog.microsync.net/uncategorized/hello-world/comment-page-1/#comment-40 Koobalou Tue, 09 Mar 2010 10:11:43 +0000 http://blog.microsync.net/?p=1#comment-40 Definitely excited to see more people started blogs, I love reading them. I have yours added to my bookmark list & will be back soon to see if you've made some progress. Definitely excited to see more people started blogs, I love reading them. I have yours added to my bookmark list & will be back soon to see if you’ve made some progress.

]]> Comment on Authentication account Joomla on ASP.NET applications by loans http://blog.microsync.net/asp-net/authentication-account-joomla-on-asp-net-applications/comment-page-1/#comment-39 loans Tue, 09 Mar 2010 03:58:36 +0000 http://blog.microsync.net/?p=5#comment-39 I want to thank the blogger very much not only for this post but also for his all previous efforts. I found blog.microsync.net to be greatly interesting. I will be coming back to blog.microsync.net for more information. I want to thank the blogger very much not only for this post but also for his all previous efforts. I found blog.microsync.net to be greatly interesting. I will be coming back to blog.microsync.net for more information.

]]> Comment on Retrieving the COM class factory for component with CLSID {} failed due to the following error: 8007007e by TeenAutoInsurance http://blog.microsync.net/programming/retrieving-the-com-class-factory-for-component-with-clsid-failed-due-to-the-following-error-8007007e/comment-page-1/#comment-38 TeenAutoInsurance Mon, 08 Mar 2010 15:13:47 +0000 http://blog.microsync.net/?p=13#comment-38 Your webpage is definitely full of great tips and also is actually extremely fun to take a look at. Nicely carried out. Your webpage is definitely full of great tips and also is actually extremely fun to take a look at.

Nicely carried out.

]]> Comment on Authentication account Joomla on ASP.NET applications by Paco http://blog.microsync.net/asp-net/authentication-account-joomla-on-asp-net-applications/comment-page-1/#comment-36 Paco Sat, 06 Mar 2010 23:15:40 +0000 http://blog.microsync.net/?p=5#comment-36 1. The salt is not enough. The salt is also stored in the database, it makes brute forcing slower, but not slow enough to prevent it. Unless when you use a very large salt. Try the tools hackers use to test your own security. You can try the backtrack md5 tools, or rainbowtables.com 2. A random class without seeds can return the same value multiple times under certain conditions (example: iis app pool recycle). That makes the value predictable and useful for hackers. You can prevent this by using a seed, like new Random(DateTime.Now.Milliseconds). A better way is to call a security specific cryptography algorithm to create the salt, like: public string CreateSalt() { var rng = new RNGCryptoServiceProvider(); var buff = new byte[saltSize]; rng.GetBytes(buff); return Convert.ToBase64String(buff); } 3. I guess it makes dataaccess more complicated because you have to write code to combine the value and split the value. It's less code and more readable code when just have separate fields in the database for the separate fields in your class. 4. When you just want to integrate with Joomla, please ignore my comments! I could better post them on the Joomla forum... A site I created had better security than you describe, and it was hacked 3 years ago. The current version is much harder to hack :) 1. The salt is not enough. The salt is also stored in the database, it makes brute forcing slower, but not slow enough to prevent it. Unless when you use a very large salt. Try the tools hackers use to test your own security. You can try the backtrack md5 tools, or rainbowtables.com
2. A random class without seeds can return the same value multiple times under certain conditions (example: iis app pool recycle). That makes the value predictable and useful for hackers. You can prevent this by using a seed, like new Random(DateTime.Now.Milliseconds). A better way is to call a security specific cryptography algorithm to create the salt, like: public string CreateSalt()
{
var rng = new RNGCryptoServiceProvider();
var buff = new byte[saltSize];
rng.GetBytes(buff);
return Convert.ToBase64String(buff);
}

3. I guess it makes dataaccess more complicated because you have to write code to combine the value and split the value. It’s less code and more readable code when just have separate fields in the database for the separate fields in your class.
4. When you just want to integrate with Joomla, please ignore my comments! I could better post them on the Joomla forum…

A site I created had better security than you describe, and it was hacked 3 years ago. The current version is much harder to hack :)

]]> Comment on Authentication account Joomla on ASP.NET applications by Mr.AD http://blog.microsync.net/asp-net/authentication-account-joomla-on-asp-net-applications/comment-page-1/#comment-35 Mr.AD Sat, 06 Mar 2010 03:34:44 +0000 http://blog.microsync.net/?p=5#comment-35 Hi, Thanks for your comment ! 1. Yes! So they add SALT to restrict exploration password. 2. That's not my algorithm! It belongs to Joomla! 3. I am not sure but I guess it helps to access data is convenient. My article just help someone who want to integrate a ASP.NET web application with Joomla ! Hi,

Thanks for your comment !

1. Yes! So they add SALT to restrict exploration password.
2. That’s not my algorithm! It belongs to Joomla!
3. I am not sure but I guess it helps to access data is convenient.

My article just help someone who want to integrate a ASP.NET web application with Joomla !

]]> Comment on Authentication account Joomla on ASP.NET applications by Paco http://blog.microsync.net/asp-net/authentication-account-joomla-on-asp-net-applications/comment-page-1/#comment-34 Paco Fri, 05 Mar 2010 15:04:11 +0000 http://blog.microsync.net/?p=5#comment-34 1. MD5 is too easy to bruteforce now. 2. The random algorithm you use without seed is predictable. 3. What is the benefit of storing the password and salt in one field? 1. MD5 is too easy to bruteforce now.
2. The random algorithm you use without seed is predictable.
3. What is the benefit of storing the password and salt in one field?

]]> Comment on 3 Free Natty Wordpress Themes To Download by Mr.AD http://blog.microsync.net/wordpress/themes/3-free-natty-wordpress-themes-to-download/comment-page-1/#comment-33 Mr.AD Wed, 03 Mar 2010 15:00:37 +0000 http://blog.microsync.net/?p=21#comment-33 Hi, That 's a good idea :) Hi,

That ’s a good idea :)

]]> Comment on 10 Plugins To Securing Your Wordpress Blog by Mr.AD http://blog.microsync.net/wordpress/10-plugins-to-securing-your-wordpress-blog/comment-page-1/#comment-32 Mr.AD Wed, 03 Mar 2010 15:00:01 +0000 http://blog.microsync.net/?p=3#comment-32 Hi, Thanks for your comment ! I know a little Russian, mean "I would like to see inscription", right ? :D Hi,

Thanks for your comment ! I know a little Russian, mean “I would like to see inscription”, right ? :D

]]>