Click here to Skip to main content
15,904,652 members
Home / Discussions / .NET (Core and Framework)
   

.NET (Core and Framework)

 
GeneralRe: Maximum connection between client and remoting server. Pin
manikandanid9-Apr-08 22:32
manikandanid9-Apr-08 22:32 
GeneralRe: Maximum connection between client and remoting server. Pin
Dave Kreskowiak10-Apr-08 1:46
mveDave Kreskowiak10-Apr-08 1:46 
GeneralSystem.IO.Ports.SerialPort memory issue on WINCE 5.0 device using .Net CF 3.5 Pin
SeanBryant8-Apr-08 14:16
SeanBryant8-Apr-08 14:16 
GeneralRe: System.IO.Ports.SerialPort memory issue on WINCE 5.0 device using .Net CF 3.5 Pin
Luc Pattyn8-Apr-08 14:39
sitebuilderLuc Pattyn8-Apr-08 14:39 
QuestionDiscover private key with value and hashed value? Pin
Mark J. Miller8-Apr-08 4:43
Mark J. Miller8-Apr-08 4:43 
GeneralRe: Discover private key with value and hashed value? Pin
Dave Kreskowiak8-Apr-08 7:11
mveDave Kreskowiak8-Apr-08 7:11 
GeneralRe: Discover private key with value and hashed value? Pin
Mark J. Miller8-Apr-08 7:17
Mark J. Miller8-Apr-08 7:17 
GeneralRe: Discover private key with value and hashed value? Pin
Dave Kreskowiak8-Apr-08 8:10
mveDave Kreskowiak8-Apr-08 8:10 
Mark J. Miller wrote:
The link to confirm would include the email address to be confirmed in plain text, and a hashed version of the same email address. So when the email is confirmed I can hash the plain text and compare the two values to make sure it hasn't been tampered with.


Why send it in plain text at all?? If the people are able to break the hash, then it's trivial for them to fake the address AND create a valid hash for it. Forget the plain text version of the address, it's just a clue to what MIGHT be in the hash. Part of security is divulging as little as possible about what the contents of the hash might be.

Instead, don't compute a one-way hash of the address. Use an symetric encryption scheme where you encrypt the address with public side of a key pair, convert it to a base 64 string to make it compatible with being in a URL, then stick that in the email. When the link is clicked, the site should convert the base64 string back into the original binary bytes, then run that through the decryption using your privatekey.

Besides, if the address doesn't show up in your "attempted, but not validated" database table, you can just ignore the address sent to you or log it in a table that tracks invalid validation attempts.


A guide to posting questions on CodeProject[^]



Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
     2006, 2007, 2008




GeneralRe: Discover private key with value and hashed value? Pin
Mark J. Miller8-Apr-08 8:18
Mark J. Miller8-Apr-08 8:18 
GeneralRe: Discover private key with value and hashed value? Pin
Mark Churchill10-Apr-08 20:00
Mark Churchill10-Apr-08 20:00 
QuestionIs there a easy Forum creator that can be easily integrated into a .NET environment? Pin
humblepgmr8-Apr-08 3:54
humblepgmr8-Apr-08 3:54 
AnswerRe: Is there a easy Forum creator that can be easily integrated into a .NET environment? Pin
Pete O'Hanlon8-Apr-08 4:30
mvePete O'Hanlon8-Apr-08 4:30 
QuestionApp.Config with xi:include Pin
K.L.K7-Apr-08 14:26
K.L.K7-Apr-08 14:26 
GeneralRe: App.Config with xi:include Pin
K.L.K7-Apr-08 15:00
K.L.K7-Apr-08 15:00 
GeneralMigrating issue Pin
soniasan7-Apr-08 8:58
soniasan7-Apr-08 8:58 
GeneralRe: Migrating issue Pin
Dave Kreskowiak7-Apr-08 10:17
mveDave Kreskowiak7-Apr-08 10:17 
GeneralRe: Migrating issue Pin
soniasan8-Apr-08 1:09
soniasan8-Apr-08 1:09 
GeneralRe: Migrating issue Pin
Dave Kreskowiak8-Apr-08 1:40
mveDave Kreskowiak8-Apr-08 1:40 
QuestionNon-static method as a thread function....How CLR do that? Pin
Secret_Garden7-Apr-08 4:28
Secret_Garden7-Apr-08 4:28 
AnswerRe: Non-static method as a thread function....How CLR do that? Pin
Mark Salsbery7-Apr-08 5:21
Mark Salsbery7-Apr-08 5:21 
AnswerRe: Non-static method as a thread function....How CLR do that? Pin
Mike Dimmick7-Apr-08 5:28
Mike Dimmick7-Apr-08 5:28 
GeneralRe: Non-static method as a thread function....How CLR do that? Pin
Secret_Garden7-Apr-08 6:02
Secret_Garden7-Apr-08 6:02 
QuestionIntegration with IPLANET throw LDAP Pin
arajeh7-Apr-08 2:12
arajeh7-Apr-08 2:12 
GeneralClickOnce and https Pin
l.m.k7-Apr-08 0:37
l.m.k7-Apr-08 0:37 
AnswerRe: ClickOnce and https Pin
Arjun Marwaha13-Apr-08 19:36
Arjun Marwaha13-Apr-08 19:36 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.